CVE-2011-1484

{"id": "CVE-2011-1484", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2011-07-27T02:42:27.203", "references": [{"url": "http://www.redhat.com/support/errata/RHSA-2011-0460.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.redhat.com/support/errata/RHSA-2011-0461.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.redhat.com/support/errata/RHSA-2011-0462.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.redhat.com/support/errata/RHSA-2011-0463.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.redhat.com/support/errata/RHSA-2011-1148.html", "source": "secalert@redhat.com"}, {"url": "http://www.redhat.com/support/errata/RHSA-2011-1251.html", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=692421", "source": "secalert@redhat.com"}, {"url": "https://docs.redhat.com/docs/en-US/JBoss_Communications_Platform/5.1/html/5.1.1_Release_Notes/ar01s05.html", "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "jboss-seam.jar in the JBoss Seam 2 framework 2.2.x and earlier, as distributed in Red Hat JBoss Enterprise SOA Platform 4.3.0.CP04 and 5.1.0 and JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3.0.CP09 and 5.1.0, does not properly restrict use of Expression Language (EL) statements in FacesMessages during page exception handling, which allows remote attackers to execute arbitrary Java code via a crafted URL to an application."}, {"lang": "es", "value": "jboss-seam.jar en el framework JBoss Seam 2 2.2.x y versiones anteriores, tal como se distribuye con la plataforma Hat JBoss Enterprise SOA 4.3.0.CP04 y 5.1.0 y JBoss Enterprise Application Platform (JBoss EAP o JBEAP) 4.3.0.CP09 y 5.1.0, no restringen el uso de instrucciones de \"Expression Language\" (EL) en FacesMessages durante el manejo de excepciones de p\u00e1gina, lo que permite a atacantes remotos ejecutar c\u00f3digo Java arbitrario a trav\u00e9s de una URL modificada a una aplicaci\u00f3n."}], "lastModified": "2011-10-26T02:58:19.950", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp09:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA7424BA-1E18-4267-9697-F4560BE75359"}, {"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "972C5C87-E982-44A5-866D-FDEACB5203B8"}, {"criteria": "cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.3.0:cp04:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "23F0650B-C39D-4C7D-8BB9-BBA951BA8AAE"}, {"criteria": "cpe:2.3:a:redhat:jboss_enterprise_soa_platform:5.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2B72D56E-DE3C-4383-906D-F3DCD9D09CC9"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BB8AAFEA-2C73-460E-AAF3-C076041C7335", "versionEndIncluding": "2.2.2"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.0.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4664C66E-3F4B-471E-AAC9-276834A55499"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.0.0:cr1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "43CACD28-B9A3-46D5-BA99-AA578F51D693"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.0.0:cr2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1A4951C4-8941-4A7F-B742-B50A812CC4B5"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.0.0:cr3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1A83D0E2-C724-47D1-9A98-7ACADA8810DA"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.0.0:ga:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56B7E191-8A62-4BDE-90A4-192BA5696A39"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.0.1:cr1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4A027797-81BC-4826-BBCC-C5EAEAB3E503"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.0.1:cr2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "67F9B8C2-D2BE-4B4A-829C-528EC716C3FF"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.0.1:ga:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D38126DF-747B-4892-9B63-E7E35F98C760"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.0.2:cr1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ECD78557-9403-496D-8512-FA693E291164"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.0.2:cr2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CB076878-0465-44C7-AE59-C9584B3CEE1F"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.0.2:ga:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F682D85A-5B8C-4F83-BABD-9D28775C3776"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.0.2:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "43DA16B0-8E35-444D-B0BC-6774BBEC9E49"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.0.3:cr1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D249483C-D9F2-474F-9DDD-775CA573A642"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.1.0:alpha1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C5BD9104-7BE9-420F-8DB2-C07748941254"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.1.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A6513765-FEB9-4D7E-AE29-E479707AED02"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.1.0:cr1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "42291710-D8D1-4C77-8A62-E0B80BA3D5AB"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.1.0:ga:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0BBFD756-FF7B-4163-9924-CC922A7EA1AF"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.1.0:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "226579DC-5DFE-4778-9871-4137B556D3A3"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.1.1:cr1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CB03E6D7-1A07-49EB-AB21-E136132BDF1E"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.1.1:cr2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "68FE6392-8774-4534-8903-BE9154FE2795"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.1.1:ga:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9F98F783-0AB2-41BE-8B07-D62438824541"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7A206D39-DBF9-4B14-8703-9081682A1EEE"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.1.2:cr1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "32B2FE67-27F7-4BF7-A78A-0A5FAAADFE20"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.1.2:cr2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1371416C-30C8-47A6-8A0C-F4E37875BE8F"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.2.0:cr1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CA790538-865A-4249-B6F9-F0CEC5818E57"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.2.0:ga:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "62AB605C-3102-4425-A563-817445B2F187"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0E6F5051-BF57-44EA-942F-9E74A06D8B45"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.2.1:cr1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0FD6DFE0-4FC8-4311-A724-666AA48A64C5"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.2.1:cr2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EB833625-4D55-4BFE-A05C-5650D342C461"}, {"criteria": "cpe:2.3:a:redhat:jboss_seam_2_framework:2.2.1:cr3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CB5F7791-FC8F-4E6C-B14D-A31D69086895"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}