$ cve CVE-2010-4417 JSON

CVE-2010-4417 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 76.3% (pctl 100)

Patch early

A public exploit exists.

Description

Unspecified vulnerability in the Services for Beehive component in Oracle Fusion Middleware 2.0.1.0, 2.0.1.1, 2.0.1.2, 2.0.1.2.1, and 2.0.1.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable third party coordinator that voice-servlet/prompt-qa/Index.jspf does not properly handle null (%00) bytes in the evaluation parameter that is used in a filename, which allows attackers to create a file with an executable extension and execute arbitrary JSP code.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	76.31% — more likely to be exploited than 100% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2011-01-19
Last modified	2026-06-16

Affected (1)

Vendor	Product
oracle	beehive

Public exploits

Source	Title	Date
exploit-db	Oracle BeeHive 2 - 'voice-servlet processEvaluation()' Write File (Metasploit)	2015-12-03

References

→ the Explorer · watch your stack · NVD