What is CVE-2010-1871?

CVE-2010-1871 is a high-severity vulnerability in NetApp Oncommand Balance, classified under Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection). CVSS score: 8.8/10. Published 2010-08-05.

How severe is CVE-2010-1871?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2010-1871 known to be exploited?

Yes. CVE-2010-1871 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2021-12-10), indicating it is being actively exploited. 21 public proof-of-concept repositories are indexed.

RCE in NetApp Oncommand Balance

CVE-2010-1871

JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.

Vulnerability class: Log4Shell (CVE-2021-44228)

Published 2010-08-05 · last modified 2026-06-16.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.834 (99.7th percentile), scored 2026-10-16.

High probability of exploitation in the next 30 days — patch promptly. 100th percentile — 99.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.834 · newest: 0.834 · change: 0.000

Affected products

NetApp Oncommand Balance
NetApp Oncommand Insight
NetApp Oncommand Unified Manager
Red Hat Enterprise Linux — versions 4, 5
Red Hat Jboss Enterprise Application Platform — versions 4.3.0

Weakness classification (CWE)

CWE-917 — Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection)

CISA KEV (Known Exploited Vulnerabilities)

This CVE is on the CISA KEV catalog, added on 2021-12-10. CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.

BOD 22-01 due date: 2022-06-10.

Required action: Apply updates per vendor instructions.

Public proof-of-concept exploits

References

www.securityfocus.com/bid/41994 (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
archives.neohapsis.com/archives/bugtraq/2013-05/0117.html (mailing-list, Broken Link)
www.securitytracker.com/id (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
www.vupen.com/english/advisories/2010/1929 (vdb-entry, Broken Link, Vendor Advisory)
bugzilla.redhat.com/show_bug.cgi (Issue Tracking)
exchange.xforce.ibmcloud.com/vulnerabilities/60794 (VDB Entry, Third Party Advisory, vdb-entry)
www.redhat.com/support/errata/RHSA-2010-0564.html (vendor-advisory, Broken Link)
security.netapp.com/advisory/ntap-20161017-0001/ (Third Party Advisory)
134c704f-9b21-4f2e-91b3-4a467353bcc0 (US Government Resource)

Frequently asked questions

What is CVE-2010-1871?: CVE-2010-1871 is a high-severity vulnerability in NetApp Oncommand Balance, classified under Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection). CVSS score: 8.8/10. Published 2010-08-05.
How severe is CVE-2010-1871?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2010-1871 known to be exploited?: Yes. CVE-2010-1871 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2021-12-10), indicating it is being actively exploited. 21 public proof-of-concept repositories are indexed.