CVE-2010-3708

23

FAUCET Score

CVE-2010-3708 is a critical vulnerability affecting the serialization implementation in JBoss Drools within Red Hat JBoss Enterprise Application Platform 4.3 (before CP09) and JBoss Enterprise SOA Platform 4.2 and 4.3. This flaw allows remote attackers to execute arbitrary code by embedding malicious class files with crafted static initializers. With a CVSS score of 7.5, this vulnerability is easily exploitable over the network with low attack complexity, potentially leading to complete compromise of confidentiality, integrity, and availability. Despite its severity, there is no public exploit code available, nor is there evidence of active exploitation or significant community discussion surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		4.3.0CPE matchmatch criteria	cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:::::::*
		4.3.0CPE matchmatch criteria	cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp01::::::
		4.3.0CPE matchmatch criteria	cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp02::::::
		4.3.0CPE matchmatch criteria	cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp03::::::
		4.3.0CPE matchmatch criteria	cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp04::::::

CVSS Data

CVSS version used by this source: 2.0

7.5HIGH

AV:N/AC:L/Au:N/C:P/I:P/A:P

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Exploitability Score

10.0

Impact Score

6.4

CvssVersion

2.0

Exploit Intelligence

EPSS Score

3.02%

Probability of exploitation in next 30 days

EPSS Percentile

86.0%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0302 is in the 75th percentile among its peer group of 51,551 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (41)

mavenpatch availablevia ghsa

Product: org.drools:drools-coreFixed in: 4.0.7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4Fixed in: glassfish-jaxb-0:2.1.4-1.17.patch04.ep1.el4

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4Fixed in: glassfish-jaxws-0:2.1.1-1jpp.ep1.13.el4

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4Fixed in: hibernate3-1:3.2.4-1.SP1_CP11.0jpp.ep2.0.el4

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4Fixed in: hibernate3-annotations-0:3.3.1-2.0.GA_CP04.ep1.el4

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4Fixed in: javassist-0:3.9.0-2.ep1.1.el4

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4Fixed in: jbossas-0:4.3.0-8.GA_CP09.2.ep1.el4

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4Fixed in: jboss-common-0:1.2.2-1.ep1.1.el4

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4Fixed in: jboss-messaging-0:1.4.0-4.SP3_CP11.1.ep1.el4

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4Fixed in: jboss-remoting-0:2.2.3-4.SP3.ep1.el4

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4Fixed in: jboss-seam-0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.22.el4

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4Fixed in: jboss-seam2-0:2.0.2.FP-1.ep1.26.el4

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4Fixed in: jbossts-1:4.2.3-2.SP5_CP10.1jpp.ep1.1.el4

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4Fixed in: jbossweb-0:2.0.0-7.CP15.0jpp.ep1.1.el4

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4Fixed in: jbossws-0:2.0.1-6.SP2_CP09.2.ep1.el4

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4Fixed in: jbossws-common-0:1.0.0-3.GA_CP06.1.ep1.el4

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4Fixed in: jgroups-1:2.4.9-1.ep1.el4

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4Fixed in: rh-eap-docs-0:4.3.0-8.GA_CP09.ep1.3.el4

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 4Fixed in: xalan-j2-0:2.7.1-4.ep1.1.el4

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5Fixed in: glassfish-jaxb-0:2.1.4-1.17.patch04.ep1.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5Fixed in: glassfish-jaxws-0:2.1.1-1jpp.ep1.13.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5Fixed in: hibernate3-1:3.2.4-1.SP1_CP11.0jpp.ep2.0.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5Fixed in: hibernate3-annotations-0:3.3.1-2.0.GA_CP04.ep1.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5Fixed in: javassist-0:3.9.0-2.ep1.1.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5Fixed in: jbossas-0:4.3.0-8.GA_CP09.2.1.ep1.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5Fixed in: jboss-common-0:1.2.2-1.ep1.1.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5Fixed in: jboss-messaging-0:1.4.0-4.SP3_CP11.1.ep1.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5Fixed in: jboss-remoting-0:2.2.3-4.SP3.ep1.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5Fixed in: jboss-seam-0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.22.el5.1

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5Fixed in: jboss-seam2-0:2.0.2.FP-1.ep1.26.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5Fixed in: jbossts-1:4.2.3-2.SP5_CP10.1jpp.ep1.1.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5Fixed in: jbossweb-0:2.0.0-7.CP15.0jpp.ep1.1.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5Fixed in: jbossws-0:2.0.1-6.SP2_CP09.2.ep1.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5Fixed in: jbossws-common-0:1.0.0-3.GA_CP06.1.ep1.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5Fixed in: jgroups-1:2.4.9-1.ep1.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5Fixed in: quartz-0:1.5.2-1jpp.patch01.ep1.4.2.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5Fixed in: rh-eap-docs-0:4.3.0-8.GA_CP09.ep1.3.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5Fixed in: xalan-j2-0:2.7.1-4.ep1.1.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss SOA Platform 4.2

redhatpatch availablevia redhat_api

Product: Red Hat JBoss SOA Platform 4.3

Vendor Advisories (2)

mavenGHSA-qvq6-cw53-rmwghigh

Drools Improper Input Validation vulnerability allows remote attackers to execute arbitrary code in JBoss EAP

redhatCVE-2010-3708Important

JBoss drools deserialization remote code execution

References

bugzilla.redhat.com / show_bug.cgi

securitytracker.com / id

issues.jboss.org / browse/SOA-2319

redhat.com / support/errata/RHSA-2010-0937.html

Vendor Advisory

redhat.com / support/errata/RHSA-2010-0938.html

Vendor Advisory

redhat.com / support/errata/RHSA-2010-0939.html

Vendor Advisory

redhat.com / support/errata/RHSA-2010-0940.html

Vendor Advisory