CVEvulnerability

CVE-2010-1428

7.5 HIGH Known exploited Published 2010-04-28 Modified 2026-10-02 Official page ↗

CISA Known Exploited Vulnerability

Red Hat JBoss Information Disclosure Vulnerability — Red Hat JBoss

Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information.

Added to KEV
2022-05-25
Remediation due
2022-06-15
Ransomware use
Known
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2010-1428
Status
Analyzed
Published
2010-04-28
Last modified
2026-10-02
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-749

Description

The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an unspecified request that uses a different method.

Affected configurations

• redhat jboss enterprise application platform 4.2.0 • redhat jboss enterprise application platform 4.3.0

Related

Weakness · CWE (1)

  • CWE-749 Exposed Dangerous Method or Function weakness

References