Red Hat · JBoss
CVE-2010-0738
Red Hat JBoss Authentication Bypass Vulnerability
Qué es
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
CISA: The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
Qué hacer
Apply updates per vendor instructions.
Plazo para las agencias federales de EE. UU.: 15 de junio de 2022
- Añadida a la lista de CISA
- 25 de mayo de 2022
- Publicada
- 28 de abril de 2010
- Gravedad
- Baja 3,7 CVSS 3.1
- Probabilidad de ataques en los próximos 30 días (EPSS)
- 74% entre el 0,5% superior de todas las vulnerabilidades conocidas
- Debilidad
- CWE-264
- Más detalles
- NVD · CVE.org · CISA
Todas las referencias (14)
- https://rhn.redhat.com/errata/RHSA-2010-0379.html
- https://rhn.redhat.com/errata/RHSA-2010-0378.html
- https://rhn.redhat.com/errata/RHSA-2010-0376.html
- https://rhn.redhat.com/errata/RHSA-2010-0377.html
- http://marc.info/?l=bugtraq&m=132129312609324&w=2
- http://marc.info/?l=bugtraq&m=132129312609324&w=2
- https://bugzilla.redhat.com/show_bug.cgi?id=574105
- http://securityreason.com/securityalert/8408
- http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=35
- http://www.vupen.com/english/advisories/2010/0992
- https://exchange.xforce.ibmcloud.com/vulnerabilities/58147
- http://www.securityfocus.com/bid/39710
- http://secunia.com/advisories/39563
- http://securitytracker.com/id?1023918
Más fallos explotados de Red Hat
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 25 may 2022 | Information Disclosure | JBoss | Media 5,9 | 53% |
| 26 ago 2026 | Race Condition | Libuser | Alto 7,4 | 8,5% |
| 26 ago 2026 | Privilege Escalation | Automatic Bug Reporting Tool | Alto 7,8 | 5,0% |
| 28 sept 2023 | Expression Language Injection | JBoss RichFaces Framework | Crítica 9,8 | 74% |
| 12 may 2023 | Incorrect Authorization | Polkit | Alto 7,8 | 24% |
| 27 jun 2022 | Out-of-Bounds Read and Write | Polkit | Alto 7,8 | 95% |
| 10 dic 2021 | Linux JBoss Seam 2 Remote Code Execution | JBoss Seam 2 | Alto 8,8 | 83% |
| 10 dic 2021 | Remote Code Execution | JBoss Application Server | Crítica 9,8 | 91% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.