PT-2010-1182 · Red Hat · Red Hat Jboss Enterprise Application Platform

Giorgio Fedon + 1 · Publicado 2010-04-28 · Atualizado 2025-04-03 · CVE-2010-0738

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Enterprise Application Platform versions 4.2 through 4.2.0.CP08 and versions 4.3 through 4.3.0.CP07

Description The issue is related to insufficient access control in the JMX-Console web application. This allows remote attackers to send requests to the application's handler using a different method, potentially disclosing protected information.

Recommendations For versions 4.2 through 4.2.0.CP08, update to version 4.2.0.CP09 or later. For versions 4.3 through 4.3.0.CP07, update to version 4.3.0.CP08 or later. As a temporary workaround, consider restricting access to the JMX-Console web application until a patch is applied.

Exploit

Correção

Enumeração de Fraquezas

CWE-749

CWE-264

Identificadores relacionados

BDU:2022-05419

CVE-2010-0738

RHSA-2010:0376

RHSA-2010:0377

RHSA-2010:0378

RHSA-2010:0379

Produtos afetados

Red Hat Jboss Enterprise Application Platform

Referências · 37

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/jboss_bshdeployer.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jboss_maindeployer.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jboss_bshdeployer.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/sap/sap_icm_urlscan.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jboss_deploymentfilerepository.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/jboss_deploymentfilerepository.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/jboss_vulnscan.rb · Exploit
• 🔥 https://github.com/ChristianPapathanasiou/jboss-autopwn · Exploit
• 🔥 https://exploit-db.com/exploits/16316 · Exploit
• 🔥 https://exploit-db.com/exploits/17924 · Exploit
• 🔥 https://exploit-db.com/exploits/16319 · Exploit
• 🔥 https://exploit-db.com/exploits/16274 · Exploit
• 🔥 http://marc.info/?l=bugtraq&m=132129312609324&w=2 · Exploit
• https://t.me/cvenotify/106430 · Publicação no Telegram
• http://vupen.com/english/advisories/2010/0992 · Aviso do Fabricante