CVEvulnerability

CVE-2010-0738

5.3 MEDIUM Known exploited Published 2010-04-28 Modified 2026-10-02 Official page ↗

CISA Known Exploited Vulnerability

Red Hat JBoss Authentication Bypass Vulnerability — Red Hat JBoss

The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.

Added to KEV
2022-05-25
Remediation due
2022-06-15
Ransomware use
Known
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2010-0738
Status
Analyzed
Published
2010-04-28
Last modified
2026-10-02
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
3.7 LOW — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-749

Description

The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.

Affected configurations

• redhat jboss enterprise application platform 4.2.0 • redhat jboss enterprise application platform 4.3.0

Related

Weakness · CWE (1)

  • CWE-749 Exposed Dangerous Method or Function weakness

References