VDB
RHSA-2011%3A0951
RHSA-2011%3A0951
PUBLISHED
CVSS 6.800000190734863 MEDIUM
jboss-seam.jar in the JBoss Seam 2 framework 2.2.x and earlier, as distributed in Red Hat JBoss Enterprise SOA Platform 4.3.0.CP05 and 5.1.0; JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3.0, 4.3.0.CP09, and 5.1.1; and JBoss Enterprise Web Platform 5.1.1, does not properly restrict use of Expression Language (EL) statements in FacesMessages during page exception handling, which allows remote attackers to execute arbitrary Java code via a crafted URL to an application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1484.
Risk Scores
CVSS 2.0
6.800000190734863
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat JBoss Enterprise Application Platform 4.3 |
Timeline
- Jul 18, 2011 CVE Published
- Nov 21, 2025 CVE Updated
- Apr 29, 2026 Distribution Patch
- Apr 29, 2026 Distribution Patch
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2011:0951 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches&product=appplatform&version=4.3.0.GA_CP09 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=712283 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0951.json advisory
- https://access.redhat.com/security/cve/CVE-2011-2196 advisory
- https://www.cve.org/CVERecord?id=CVE-2011-2196 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2011-2196 advisory