Description
jboss-seam.jar in the JBoss Seam 2 framework 2.2.x and earlier, as distributed in Red Hat JBoss Enterprise SOA Platform 4.3.0.CP04 and 5.1.0 and JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3.0.CP09 and 5.1.0, does not properly restrict use of Expression Language (EL) statements in FacesMessages during page exception handling, which allows remote attackers to execute arbitrary Java code via a crafted URL to an application.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 5 | jboss-seam2 +3 | 2.2.2.EAP-17.el4_8 | RHSA-2011:0461 |
| Red Hat JBoss EAP 4 | jboss-seam2 +1 | 2.0.2.FP-1.ep1.27.el4 | RHSA-2011:0460 |
Advisories 2
- RHSA-2011:0461 Red Hat Security Advisory: jboss-seam2 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2011:0460 Red Hat Security Advisory: jboss-seam2 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- RHSA-2011:1251 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=692421
- RHSA-2011:0462 vendor-advisory
- RHSA-2011:0463 vendor-advisory
- RHSA-2011:0461 vendor-advisory
- RHSA-2011:0460 vendor-advisory
- RHSA-2011:1148 vendor-advisory
- https://docs.redhat.com/docs/en-US/JBoss_Communications_Platform/5.1/html/5.1.1_Release_Notes/ar01s05.html