Red Hat · JBoss
CVE-2010-1428
Red Hat JBoss Information Disclosure Vulnerability
What it is
The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an unspecified request that uses a different method.
CISA: Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: June 15, 2022
- Added to the CISA list
- May 25, 2022
- Published
- April 28, 2010
- Severity
- Medium 5.9 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 53% in the top 1.0% of all known vulnerabilities
- Weakness
- CWE-264
- More details
- NVD · CVE.org · CISA
All references (12)
- https://rhn.redhat.com/errata/RHSA-2010-0379.html
- https://rhn.redhat.com/errata/RHSA-2010-0378.html
- http://marc.info/?l=bugtraq&m=132698550418872&w=2
- https://rhn.redhat.com/errata/RHSA-2010-0376.html
- https://rhn.redhat.com/errata/RHSA-2010-0377.html
- http://marc.info/?l=bugtraq&m=132698550418872&w=2
- https://exchange.xforce.ibmcloud.com/vulnerabilities/58148
- https://bugzilla.redhat.com/show_bug.cgi?id=585899
- http://www.vupen.com/english/advisories/2010/0992
- http://securitytracker.com/id?1023917
- http://www.securityfocus.com/bid/39710
- http://secunia.com/advisories/39563
More exploited flaws from Red Hat
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 25, 2022 | Authentication Bypass | JBoss | Low 3.7 | 74% |
| Aug 26, 2026 | Race Condition | Libuser | High 7.4 | 8.5% |
| Aug 26, 2026 | Privilege Escalation | Automatic Bug Reporting Tool | High 7.8 | 5.0% |
| Sep 28, 2023 | Expression Language Injection | JBoss RichFaces Framework | Critical 9.8 | 74% |
| May 12, 2023 | Incorrect Authorization | Polkit | High 7.8 | 24% |
| Jun 27, 2022 | Out-of-Bounds Read and Write | Polkit | High 7.8 | 95% |
| Dec 10, 2021 | Linux JBoss Seam 2 Remote Code Execution | JBoss Seam 2 | High 8.8 | 83% |
| Dec 10, 2021 | Remote Code Execution | JBoss Application Server | Critical 9.8 | 91% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.