CVE:CVE-2011-2196
CNNVD:CNNVD-201107-313
Red Hat JBoss Enterprise Application Platform（JBoss Eap）是美国红帽（Red Hat）公司的一个基于订阅的/基于 Java Ee 的开源应用服务器运行时平台。用于构建，部署和托管由 Red Hat 开发和维护的高度事务性 Java 应用程序和服务。
部分Red Hat产品存在权限许可和访问控制问题漏洞。远程攻击者利用该漏洞在应用程序环境中执行任意Java代码。以下产品及版本受到影响：JBoss Seam 2 framework 2.2.x版本及之前版本、Red Hat JBoss Enterprise SOA Platform 4.3.0.CP05版本和5.1.0版本、JBoss Enterprise Application Platform 4.3.0版本、4.3.0.CP09版本、5.1.1版本、JBoss Enterprise Web Platform 5.1.1版本。
solution:Upgrade redhat jboss_enterprise_application_platform to a higher version than 4.3.0,4.3.0:cp09,5.1.1,and avoid the version 4.3.0,4.3.0:cp09,5.1.1; Upgrade redhat jboss_enterprise_soa_platform to a higher version than 4.3.0:cp05,5.1.0,and avoid the version 4.3.0:cp05,5.1.0; Upgrade redhat jboss_enterprise_web_platform to a higher version than 5.1.1,and avoid the version 5.1.1; Upgrade redhat jboss_seam_2_framework to a higher version than 2.2.2,2.0.0:beta1,2.0.0:cr1,2.0.0:cr2,2.0.0:cr3,2.0.0:ga,2.0.1:cr1,2.0.1:cr2,2.0.1:ga,2.0.2:cr1,2.0.2:cr2,2.0.2:ga,2.0.2:sp1,2.0.3:cr1,2.1.0:alpha1,2.1.0:beta1,2.1.0:cr1,2.1.0:ga,2.1.0:sp1,2.1.1:cr1,2.1.1:cr2,2.1.1:ga,2.1.2,2.1.2:cr1,2.1.2:cr2,2.2.0:cr1,2.2.0:ga,2.2.1,2.2.1:cr1,2.2.1:cr2,2.2.1:cr3,and avoid the version (,2.2.2],2.0.0:beta1,2.0.0:cr1,2.0.0:cr2,2.0.0:cr3,2.0.0:ga,2.0.1:cr1,2.0.1:cr2,2.0.1:ga,2.0.2:cr1,2.0.2:cr2,2.0.2:ga,2.0.2:sp1,2.0.3:cr1,2.1.0:alpha1,2.1.0:beta1,2.1.0:cr1,2.1.0:ga,2.1.0:sp1,2.1.1:cr1,2.1.1:cr2,2.1.1:ga,2.1.2,2.1.2:cr1,2.1.2:cr2,2.2.0:cr1,2.2.0:ga,2.2.1,2.2.1:cr1,2.2.1:cr2,2.2.1:cr3