CVE-2010-1428
Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information.
The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an unspecified request that uses a different method.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N- marc.info/?l=bugtraq&m=132698550418872&w=2ExploitMailing List
- secunia.com/advisories/39563Broken LinkVendor Advisory
- securitytracker.com/id?1023917Broken LinkThird Party Advisory
- securityfocus.com/bid/39710Broken LinkThird Party Advisory
- vupen.com/english/advisories/2010/0992Broken LinkVendor Advisory
- bugzilla.redhat.com/show_bug.cgi?id=585899Issue Tracking
- exchange.xforce.ibmcloud.com/vulnerabilities/58148Third Party AdvisoryVDB Entry
- rhn.redhat.com/errata/RHSA-2010-0376.htmlBroken LinkVendor Advisory
- rhn.redhat.com/errata/RHSA-2010-0377.htmlBroken Link
- rhn.redhat.com/errata/RHSA-2010-0378.htmlBroken Link
- rhn.redhat.com/errata/RHSA-2010-0379.htmlVendor Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-1428Broken Link
Actively exploited and used by ransomware crews. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1594 days
- Ransomware
- Used in known ransomware campaigns
- CVSS
- 7.5 HIGH
- EPSS (30-day exploit probability)
- 52.7% · top 1% of all CVEs
- Weakness
- NVD-CWE-noinfo
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
- 5.Verify offline/immutable backups and segment the affected systems. This flaw is used for ransomware initial access.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.