Red Hat · JBoss
CVE-2010-0738
Red Hat JBoss Authentication Bypass Vulnerability
What it is
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
CISA: The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: June 15, 2022
- Added to the CISA list
- May 25, 2022
- Published
- April 28, 2010
- Severity
- Low 3.7 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 74% in the top 0.5% of all known vulnerabilities
- Weakness
- CWE-264
- More details
- NVD · CVE.org · CISA
All references (14)
- https://rhn.redhat.com/errata/RHSA-2010-0379.html
- https://rhn.redhat.com/errata/RHSA-2010-0378.html
- https://rhn.redhat.com/errata/RHSA-2010-0376.html
- https://rhn.redhat.com/errata/RHSA-2010-0377.html
- http://marc.info/?l=bugtraq&m=132129312609324&w=2
- http://marc.info/?l=bugtraq&m=132129312609324&w=2
- https://bugzilla.redhat.com/show_bug.cgi?id=574105
- http://securityreason.com/securityalert/8408
- http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=35
- http://www.vupen.com/english/advisories/2010/0992
- https://exchange.xforce.ibmcloud.com/vulnerabilities/58147
- http://www.securityfocus.com/bid/39710
- http://secunia.com/advisories/39563
- http://securitytracker.com/id?1023918
More exploited flaws from Red Hat
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 25, 2022 | Information Disclosure | JBoss | Medium 5.9 | 53% |
| Aug 26, 2026 | Race Condition | Libuser | High 7.4 | 8.5% |
| Aug 26, 2026 | Privilege Escalation | Automatic Bug Reporting Tool | High 7.8 | 5.0% |
| Sep 28, 2023 | Expression Language Injection | JBoss RichFaces Framework | Critical 9.8 | 74% |
| May 12, 2023 | Incorrect Authorization | Polkit | High 7.8 | 24% |
| Jun 27, 2022 | Out-of-Bounds Read and Write | Polkit | High 7.8 | 95% |
| Dec 10, 2021 | Linux JBoss Seam 2 Remote Code Execution | JBoss Seam 2 | High 8.8 | 83% |
| Dec 10, 2021 | Remote Code Execution | JBoss Application Server | Critical 9.8 | 91% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.