PT-2010-1180 · Red Hat · Red Hat Jboss Enterprise Application Platform

Marc Schoenefeld · Published 2010-04-26 · Updated 2025-04-03 · CVE-2010-1428

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Enterprise Application Platform versions 4.2 through 4.2.0.CP08 Red Hat JBoss Enterprise Application Platform versions 4.3 through 4.3.0.CP07

Description The issue is related to insufficient access control in the Web Console of JBoss Enterprise Application Platform, which can be exploited by a remote attacker to obtain sensitive information. This can be achieved by sending a specially crafted request using a method other than GET or POST.

Recommendations For Red Hat JBoss Enterprise Application Platform versions 4.2 through 4.2.0.CP08, update to version 4.2.0.CP09 or later. For Red Hat JBoss Enterprise Application Platform versions 4.3 through 4.3.0.CP07, update to version 4.3.0.CP08 or later. As a temporary workaround, consider restricting access to the Web Console to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-749

CWE-264

Related Identifiers

BDU:2022-05191

CVE-2010-1428

RHSA-2010:0376

RHSA-2010:0377

RHSA-2010:0378

RHSA-2010:0379

Affected Products

Red Hat Jboss Enterprise Application Platform

References · 22

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/jboss_vulnscan.rb · Exploit
• 🔥 http://marc.info/?l=bugtraq&m=132698550418872&w=2 · Exploit
• https://rhn.redhat.com/errata/RHSA-2010-0378.html · Vendor Advisory
• http://vupen.com/english/advisories/2010/0992 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05191 · Security Note
• https://rhn.redhat.com/errata/RHSA-2010-0376.html · Vendor Advisory
• http://secunia.com/advisories/39563 · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2010-0379.html · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2010-0377.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1428 · Security Note
• https://t.me/cvenotify/117599 · Telegram Post
• https://t.me/cvenotify/84800 · Telegram Post
• http://securitytracker.com/id?1023917 · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=585899 · Note