CVE-2010-3708 — JBoss drools deserialization remote code execution

Back Back to CVE browser

HIGH

JBoss drools deserialization remote code execution

Published Dec 30, 2010

7.5

HIGH

CVSS 2.0

EPSS 3.02%

Description

The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files, which allows remote attackers to execute arbitrary code via a crafted static initializer.

Affected products

Red Hat JBoss Enterprise Application Platform 4.3

n/a

Fixed · RHSA-2010:0939
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4

glassfish-jaxb-0:2.1.4-1.17.patch04.ep1.el4

Fixed · RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4

glassfish-jaxws-0:2.1.1-1jpp.ep1.13.el4

Fixed · RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4

hibernate3-1:3.2.4-1.SP1_CP11.0jpp.ep2.0.el4

Fixed · RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4

hibernate3-annotations-0:3.3.1-2.0.GA_CP04.ep1.el4

Fixed · RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4

javassist-0:3.9.0-2.ep1.1.el4

Fixed · RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4

jboss-common-0:1.2.2-1.ep1.1.el4

Fixed · RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4

jboss-messaging-0:1.4.0-4.SP3_CP11.1.ep1.el4

Fixed · RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4

jboss-remoting-0:2.2.3-4.SP3.ep1.el4

Fixed · RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4

jboss-seam-0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.22.el4

Fixed · RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4

jboss-seam2-0:2.0.2.FP-1.ep1.26.el4

Fixed · RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4

jbossas-0:4.3.0-8.GA_CP09.2.ep1.el4

Fixed · RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4

jbossts-1:4.2.3-2.SP5_CP10.1jpp.ep1.1.el4

Fixed · RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4

jbossweb-0:2.0.0-7.CP15.0jpp.ep1.1.el4

Fixed · RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4

jbossws-0:2.0.1-6.SP2_CP09.2.ep1.el4

Fixed · RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4

jbossws-common-0:1.0.0-3.GA_CP06.1.ep1.el4

Fixed · RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4

jgroups-1:2.4.9-1.ep1.el4

Fixed · RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4

rh-eap-docs-0:4.3.0-8.GA_CP09.ep1.3.el4

Fixed · RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4

xalan-j2-0:2.7.1-4.ep1.1.el4

Fixed · RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5

glassfish-jaxb-0:2.1.4-1.17.patch04.ep1.el5

Fixed · RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5

glassfish-jaxws-0:2.1.1-1jpp.ep1.13.el5

Fixed · RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5

hibernate3-1:3.2.4-1.SP1_CP11.0jpp.ep2.0.el5

Fixed · RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5

hibernate3-annotations-0:3.3.1-2.0.GA_CP04.ep1.el5

Fixed · RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5

javassist-0:3.9.0-2.ep1.1.el5

Fixed · RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5

jboss-common-0:1.2.2-1.ep1.1.el5

Fixed · RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5

jboss-messaging-0:1.4.0-4.SP3_CP11.1.ep1.el5

Fixed · RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5

jboss-remoting-0:2.2.3-4.SP3.ep1.el5

Fixed · RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5

jboss-seam-0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.22.el5.1

Fixed · RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5

jboss-seam2-0:2.0.2.FP-1.ep1.26.el5

Fixed · RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5

jbossas-0:4.3.0-8.GA_CP09.2.1.ep1.el5

Fixed · RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5

jbossts-1:4.2.3-2.SP5_CP10.1jpp.ep1.1.el5

Fixed · RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5

jbossweb-0:2.0.0-7.CP15.0jpp.ep1.1.el5

Fixed · RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5

jbossws-0:2.0.1-6.SP2_CP09.2.ep1.el5

Fixed · RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5

jbossws-common-0:1.0.0-3.GA_CP06.1.ep1.el5

Fixed · RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5

jgroups-1:2.4.9-1.ep1.el5

Fixed · RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5

quartz-0:1.5.2-1jpp.patch01.ep1.4.2.el5

Fixed · RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5

rh-eap-docs-0:4.3.0-8.GA_CP09.ep1.3.el5

Fixed · RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5

xalan-j2-0:2.7.1-4.ep1.1.el5

Fixed · RHSA-2010:0938
Red Hat JBoss SOA Platform 4.2

n/a

Fixed · RHSA-2010:0940
Red Hat JBoss SOA Platform 4.3

n/a

Fixed · RHSA-2010:0940

Product	Package	State	Advisory
Red Hat JBoss Enterprise Application Platform 4.3	n/a	Fixed	RHSA-2010:0939
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4	glassfish-jaxb-0:2.1.4-1.17.patch04.ep1.el4	Fixed	RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4	glassfish-jaxws-0:2.1.1-1jpp.ep1.13.el4	Fixed	RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4	hibernate3-1:3.2.4-1.SP1_CP11.0jpp.ep2.0.el4	Fixed	RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4	hibernate3-annotations-0:3.3.1-2.0.GA_CP04.ep1.el4	Fixed	RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4	javassist-0:3.9.0-2.ep1.1.el4	Fixed	RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4	jboss-common-0:1.2.2-1.ep1.1.el4	Fixed	RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4	jboss-messaging-0:1.4.0-4.SP3_CP11.1.ep1.el4	Fixed	RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4	jboss-remoting-0:2.2.3-4.SP3.ep1.el4	Fixed	RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4	jboss-seam-0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.22.el4	Fixed	RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4	jboss-seam2-0:2.0.2.FP-1.ep1.26.el4	Fixed	RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4	jbossas-0:4.3.0-8.GA_CP09.2.ep1.el4	Fixed	RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4	jbossts-1:4.2.3-2.SP5_CP10.1jpp.ep1.1.el4	Fixed	RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4	jbossweb-0:2.0.0-7.CP15.0jpp.ep1.1.el4	Fixed	RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4	jbossws-0:2.0.1-6.SP2_CP09.2.ep1.el4	Fixed	RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4	jbossws-common-0:1.0.0-3.GA_CP06.1.ep1.el4	Fixed	RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4	jgroups-1:2.4.9-1.ep1.el4	Fixed	RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4	rh-eap-docs-0:4.3.0-8.GA_CP09.ep1.3.el4	Fixed	RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4	xalan-j2-0:2.7.1-4.ep1.1.el4	Fixed	RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5	glassfish-jaxb-0:2.1.4-1.17.patch04.ep1.el5	Fixed	RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5	glassfish-jaxws-0:2.1.1-1jpp.ep1.13.el5	Fixed	RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5	hibernate3-1:3.2.4-1.SP1_CP11.0jpp.ep2.0.el5	Fixed	RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5	hibernate3-annotations-0:3.3.1-2.0.GA_CP04.ep1.el5	Fixed	RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5	javassist-0:3.9.0-2.ep1.1.el5	Fixed	RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5	jboss-common-0:1.2.2-1.ep1.1.el5	Fixed	RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5	jboss-messaging-0:1.4.0-4.SP3_CP11.1.ep1.el5	Fixed	RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5	jboss-remoting-0:2.2.3-4.SP3.ep1.el5	Fixed	RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5	jboss-seam-0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.22.el5.1	Fixed	RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5	jboss-seam2-0:2.0.2.FP-1.ep1.26.el5	Fixed	RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5	jbossas-0:4.3.0-8.GA_CP09.2.1.ep1.el5	Fixed	RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5	jbossts-1:4.2.3-2.SP5_CP10.1jpp.ep1.1.el5	Fixed	RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5	jbossweb-0:2.0.0-7.CP15.0jpp.ep1.1.el5	Fixed	RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5	jbossws-0:2.0.1-6.SP2_CP09.2.ep1.el5	Fixed	RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5	jbossws-common-0:1.0.0-3.GA_CP06.1.ep1.el5	Fixed	RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5	jgroups-1:2.4.9-1.ep1.el5	Fixed	RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5	quartz-0:1.5.2-1jpp.patch01.ep1.4.2.el5	Fixed	RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5	rh-eap-docs-0:4.3.0-8.GA_CP09.ep1.3.el5	Fixed	RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5	xalan-j2-0:2.7.1-4.ep1.1.el5	Fixed	RHSA-2010:0938
Red Hat JBoss SOA Platform 4.2	n/a	Fixed	RHSA-2010:0940
Red Hat JBoss SOA Platform 4.3	n/a	Fixed	RHSA-2010:0940

Remediation

No remediation recorded yet.

Metrics

3.02% 0.03017

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.03017

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (12 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	3.02% (0.03017)	86.99th	v5 (v2026.06.15)
Jun 15, 2026	3.02% (0.03017)	85.66th	v5 (v2026.06.15)
Mar 30, 2025	1.87% (0.01869)	81.47th	v4 (v2025.03.14)
Mar 29, 2025	5.32% (0.05319)	83.04th	v4 (v2025.03.14)
Mar 17, 2025	2.12% (0.02124)	82.97th	v4 (v2025.03.14)
Dec 12, 2024	11.25% (0.11255)	95.45th	v3 (v2023.03.01)
Aug 20, 2023	11.25% (0.11255)	94.45th	v3 (v2023.03.01)
Jun 30, 2023	10.72% (0.10719)	94.24th	v3 (v2023.03.01)
Mar 7, 2023	10.30% (0.10299)	94.00th	v3 (v2023.03.01)
Mar 6, 2023	7.78% (0.07777)	93.24th	v2 (v2022.01.01)
Apr 1, 2022	7.78% (0.07777)	92.60th	v2 (v2022.01.01)
Feb 4, 2022	7.78% (0.07777)	81.54th	v2 (v2022.01.01)

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-502

Deserialization of Untrusted Data

References (12)

http://securitytracker.com/id?1024813
vdb-entryx_refsource_SECTRACK
http://www.redhat.com/support/errata/RHSA-2010-0937.html
vendor-advisoryx_refsource_REDHATVendor Advisory
http://www.redhat.com/support/errata/RHSA-2010-0938.html
vendor-advisoryx_refsource_REDHATVendor Advisory
http://www.redhat.com/support/errata/RHSA-2010-0939.html
vendor-advisoryx_refsource_REDHATVendor Advisory
http://www.redhat.com/support/errata/RHSA-2010-0940.html
vendor-advisoryx_refsource_REDHATVendor Advisory
https://access.redhat.com/security/cve/CVE-2010-3708
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=633859
x_refsource_CONFIRMIssue Tracking
https://github.com/advisories/GHSA-qvq6-cw53-rmwg
Advisory
https://issues.jboss.org/browse/SOA-2319
x_refsource_MISC
https://nvd.nist.gov/vuln/detail/CVE-2010-3708
https://web.archive.org/web/20111025030056/http://securitytracker.com/id?1024813
https://www.cve.org/CVERecord?id=CVE-2010-3708

Link	Providers	Tags
http://securitytracker.com/id?1024813		vdb-entryx_refsource_SECTRACK
http://www.redhat.com/support/errata/RHSA-2010-0937.html		vendor-advisoryx_refsource_REDHATVendor Advisory
http://www.redhat.com/support/errata/RHSA-2010-0938.html		vendor-advisoryx_refsource_REDHATVendor Advisory
http://www.redhat.com/support/errata/RHSA-2010-0939.html		vendor-advisoryx_refsource_REDHATVendor Advisory
http://www.redhat.com/support/errata/RHSA-2010-0940.html		vendor-advisoryx_refsource_REDHATVendor Advisory
https://access.redhat.com/security/cve/CVE-2010-3708		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=633859		x_refsource_CONFIRMIssue Tracking
https://github.com/advisories/GHSA-qvq6-cw53-rmwg		Advisory
https://issues.jboss.org/browse/SOA-2319		x_refsource_MISC
https://nvd.nist.gov/vuln/detail/CVE-2010-3708
https://web.archive.org/web/20111025030056/http://securitytracker.com/id?1024813
https://www.cve.org/CVERecord?id=CVE-2010-3708