[JBPAPP-6387] JBoss Seam2 privilege escalation caused by EL interpolation in FacesMessages - JBoss Issue Tracker

XML

Word

Printable

Affects:

Release Notes
Release Notes Text:

Hide
It was found that JBoss Seam 2 did not properly block access to JBoss
Expression Language (EL) constructs in page exception handling, allowing
arbitrary Java methods to be executed. A remote attacker could use this
flaw to execute arbitrary code via a specially-crafted URL provided to
certain applications based on the JBoss Seam 2 framework. Note: A properly
configured and enabled Java Security Manager would prevent exploitation of
this flaw. (CVE-2011-1484)

Show
It was found that JBoss Seam 2 did not properly block access to JBoss Expression Language (EL) constructs in page exception handling, allowing arbitrary Java methods to be executed. A remote attacker could use this flaw to execute arbitrary code via a specially-crafted URL provided to certain applications based on the JBoss Seam 2 framework. Note: A properly configured and enabled Java Security Manager would prevent exploitation of this flaw. (CVE-2011-1484)
Release Notes Docs Status:
Documented as Resolved Issue
Docs QE Status:
ASSIGNED

Back port one-off patch into regular branch, details are at https://bugzilla.redhat.com/show_bug.cgi?id=692421

cloned to

JBPAPP-6388 JBoss Seam2 privilege escalation caused by EL interpolation in FacesMessages