Is CVE-2011-2196 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 3%.

What products does CVE-2011-2196 affect?

Tracked products affected include JBoss. Check the version you run to see whether it is affected.

How do I fix CVE-2011-2196?

Apply the vendor fix in your normal patch cycle. Upgrade affected products to a fixed version.

CVE-2011-2196

Q: What is CVE-2011-2196?

CVE-2011-2196 is a medium-severity software vulnerability (CWE-264) with a CVSS score of 6.8. jboss-seam.jar in the JBoss Seam 2 framework 2.2.x and earlier, as distributed in Red Hat JBoss Enterprise SOA Platform 4.3.0.CP05 and 5.1.0; JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3.0, 4.3.0.CP09, and 5.1.1; and J

MEDIUM severity · CVSS 6.8 · CWE-264

6.8CVSS MEDIUM

Summary

jboss-seam.jar in the JBoss Seam 2 framework 2.2.x and earlier, as distributed in Red Hat JBoss Enterprise SOA Platform 4.3.0.CP05 and 5.1.0; JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3.0, 4.3.0.CP09, and 5.1.1; and JBoss Enterprise Web Platform 5.1.1, does not properly restrict use of Expression Language (EL) statements in FacesMessages during page exception handling, which allows remote attackers to execute arbitrary Java code via a crafted URL to an application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1484.

Impact & exploitability

Attack vectorNetwork

Attack complexity—

Privileges required—

User interaction—

Confidentiality impact—

Integrity impact—

Availability impact—

Exploit probability (EPSS)3%

AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products we track (1)

JBoss

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

CVE-2011-2196

Summary

Impact & exploitability

Affected products we track (1)

Recommendation

Additional information