CVE-2010-0738: Red Hat JBoss Authentication Bypass Vulnerability

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: yes — in CISA KEV since 2022-05-25
EPSS: 73.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2010-04-28 · updated 2026-10-02
Weakness: CWE-749

Description

The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.

Affected products

Red Hat JBoss EAP: 4.2.0, 4.3.0

References

http://marc.info/?l=bugtraq&m=132129312609324&w=2
http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=35
http://secunia.com/advisories/39563
http://securityreason.com/securityalert/8408
http://securitytracker.com/id?1023918
http://www.securityfocus.com/bid/39710
http://www.vupen.com/english/advisories/2010/0992
https://bugzilla.redhat.com/show_bug.cgi?id=574105
https://exchange.xforce.ibmcloud.com/vulnerabilities/58147
https://rhn.redhat.com/errata/RHSA-2010-0376.html
https://rhn.redhat.com/errata/RHSA-2010-0377.html
https://rhn.redhat.com/errata/RHSA-2010-0378.html

Get alerted when CVE-2010-0738 or the next vulnerability affects your stack