high7.5Known exploited
CVE-2010-1428
Red Hat JBoss Information Disclosure Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-05-25. Federal due date: 2022-06-15.
Apply updates per vendor instructions.
Impact
The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an unspecified request that uses a different method.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Jboss Enterprise Application Platform | Versions 4.2.0, 4.3.0 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://marc.info/?l=bugtraq&m=132698550418872&w=2
- http://secunia.com/advisories/39563
- http://securitytracker.com/id?1023917
- http://www.securityfocus.com/bid/39710
- http://www.vupen.com/english/advisories/2010/0992
- https://bugzilla.redhat.com/show_bug.cgi?id=585899
- https://exchange.xforce.ibmcloud.com/vulnerabilities/58148
- https://rhn.redhat.com/errata/RHSA-2010-0376.html
- https://rhn.redhat.com/errata/RHSA-2010-0377.html
- https://rhn.redhat.com/errata/RHSA-2010-0378.html
- https://rhn.redhat.com/errata/RHSA-2010-0379.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-1428