Description

The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files, which allows remote attackers to execute arbitrary code via a crafted static initializer.

Remediation

References

CVE-2010-3708

Related Vulnerabilities

WordPress Plugin Page Builder:KingComposer-Free Drag and Drop page builder by King-Theme Cross-Site Scripting (2.9.4)

MySQL CVE-2016-3440 Vulnerability (CVE-2016-3440)

WordPress Plugin WP Google Maps Multiple Cross-Site Scripting Vulnerabilities (6.0.26)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-12471)

Craft CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-12823)

Severity

High

Tags

Missing Update Known Vulnerabilities CWE-20 CVE-2010-3708