VDB
RHSA-2011%3A0952
RHSA-2011%3A0952
PUBLISHED
CVSS 6.800000190734863 MEDIUM
jboss-seam.jar in the JBoss Seam 2 framework 2.2.x and earlier, as distributed in Red Hat JBoss Enterprise SOA Platform 4.3.0.CP05 and 5.1.0; JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3.0, 4.3.0.CP09, and 5.1.1; and JBoss Enterprise Web Platform 5.1.1, does not properly restrict use of Expression Language (EL) statements in FacesMessages during page exception handling, which allows remote attackers to execute arbitrary Java code via a crafted URL to an application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1484.
Risk Scores
CVSS 2.0
6.800000190734863
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat JBoss SOA Platform 4.3 | |
| Red Hat | Red Hat JBoss SOA Platform 5.1 |
Timeline
- Jul 18, 2011 CVE Published
- Nov 21, 2025 CVE Updated
- Apr 29, 2026 Distribution Patch
- Apr 29, 2026 Distribution Patch
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2011:0952 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=soaplatform&downloadType=securityPatches&version=4.3.0.GA_CP05 advisory
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=soaplatform&downloadType=securityPatches&version=5.1.0+GA advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=712283 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0952.json advisory
- https://access.redhat.com/security/cve/CVE-2011-2196 advisory
- https://www.cve.org/CVERecord?id=CVE-2011-2196 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2011-2196 advisory