CVE-2010-1428: Red Hat JBoss Information Disclosure Vulnerability

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: yes — in CISA KEV since 2022-05-25
EPSS: 52.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2010-04-28 · updated 2026-10-02
Weakness: CWE-749

Description

The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an unspecified request that uses a different method.

Affected products

Red Hat JBoss EAP: 4.2.0, 4.3.0

References

http://marc.info/?l=bugtraq&m=132698550418872&w=2
http://secunia.com/advisories/39563
http://securitytracker.com/id?1023917
http://www.securityfocus.com/bid/39710
http://www.vupen.com/english/advisories/2010/0992
https://bugzilla.redhat.com/show_bug.cgi?id=585899
https://exchange.xforce.ibmcloud.com/vulnerabilities/58148
https://rhn.redhat.com/errata/RHSA-2010-0376.html
https://rhn.redhat.com/errata/RHSA-2010-0377.html
https://rhn.redhat.com/errata/RHSA-2010-0378.html
https://rhn.redhat.com/errata/RHSA-2010-0379.html
http://marc.info/?l=bugtraq&m=132698550418872&w=2

Get alerted when CVE-2010-1428 or the next vulnerability affects your stack