CVE-2010-3708

The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files, which allows remote attackers to execute arbitrary code via a crafted static initializer.

• CWE-20

• http://securitytracker.com/id?1024813
• http://www.redhat.com/support/errata/RHSA-2010-0937.htmlVendor Advisory
• http://www.redhat.com/support/errata/RHSA-2010-0938.htmlVendor Advisory
• http://www.redhat.com/support/errata/RHSA-2010-0939.htmlVendor Advisory
• http://www.redhat.com/support/errata/RHSA-2010-0940.htmlVendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=633859
• https://issues.jboss.org/browse/SOA-2319
• http://securitytracker.com/id?1024813
• http://www.redhat.com/support/errata/RHSA-2010-0937.htmlVendor Advisory
• http://www.redhat.com/support/errata/RHSA-2010-0938.htmlVendor Advisory
• http://www.redhat.com/support/errata/RHSA-2010-0939.htmlVendor Advisory
• http://www.redhat.com/support/errata/RHSA-2010-0940.htmlVendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=633859
• https://issues.jboss.org/browse/SOA-2319

Published

Dec 30, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-3702The Gfx::getPos function in the PDF parser in xpdf before 3.…
• CVE-2010-3703The PostScriptFunction::PostScriptFunction function in poppl…
• CVE-2010-3704The FoFiType1::parse function in fofi/FoFiType1.cc in the PD…
• CVE-2010-3705The sctp_auth_asoc_get_hmac function in net/sctp/auth.c in t…
• CVE-2010-3706plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.…
• CVE-2010-3707plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.…
• CVE-2010-3709The ZipArchive::getArchiveComment function in PHP 5.2.x thro…
• CVE-2010-3710Stack consumption vulnerability in the filter_var function i…
• CVE-2010-3711libpurple in Pidgin before 2.7.4 does not properly validate …
• CVE-2010-3712Cross-site scripting (XSS) vulnerability in Joomla! 1.5.x be…
• CVE-2010-3713rss.php in UseBB before 1.0.11 does not properly handle foru…
• CVE-2010-3714The jumpUrl (aka access tracking) implementation in tslib/cl…