CVE-2010-1428
High · 7.5 CISA KEV · ransomwareCVSS
7.5
EPSS
61.5%
Published
Apr 28, 2010
CISA due date
Jun 15, 2022
The record
The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an unspecified request that uses a different method.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | hibernate3 | 0 | 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | hibernate3-annotations | 0 | 0:3.3.1-1.12.GA_CP03.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | hibernate3-annotations-javadoc | 0 | 0:3.3.1-1.12.GA_CP03.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | hibernate3-javadoc | 0 | 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | hsqldb | 0 | 1:1.8.0.8-3.patch03.1jpp.ep1.3.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | jacorb | 0 | 0:2.3.0-1jpp.ep1.10.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | jakarta-commons-httpclient | 0 | 1:3.0.1-1.patch01.1jpp.ep1.4.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | jboss-aop | 0 | 0:1.5.5-3.CP05.2.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | jboss-cache | 0 | 0:1.4.1-6.SP14.1.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | jboss-remoting | 0 | 0:2.2.3-3.SP2.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | jboss-seam | 0 | 0:1.2.1-1.ep1.24.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | jboss-seam-docs | 0 | 0:1.2.1-1.ep1.24.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | jbossas | 0 | 0:4.2.0-6.GA_CP09.6.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | jbossas-4.2.0.GA_CP09-bin | 0 | 0:4.2.0-6.GA_CP09.6.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | jbossas-client | 0 | 0:4.2.0-6.GA_CP09.6.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | jbossts | 0 | 1:4.2.3-1.SP5_CP09.1jpp.ep1.1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | jbossweb | 0 | 0:2.0.0-6.CP13.0jpp.ep1.1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | rh-eap-docs | 0 | 0:4.2.0-7.GA_CP09.ep1.5.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | rh-eap-docs-examples | 0 | 0:4.2.0-7.GA_CP09.ep1.5.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | hibernate3 | 0 | 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | hibernate3-annotations | 0 | 0:3.3.1-1.12.GA_CP03.ep1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | hibernate3-annotations-javadoc | 0 | 0:3.3.1-1.12.GA_CP03.ep1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | hibernate3-javadoc | 0 | 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | jacorb | 0 | 0:2.3.0-1jpp.ep1.10.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | jboss-aop | 0 | 0:1.5.5-3.CP05.2.ep1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | jboss-cache | 0 | 0:1.4.1-6.SP14.1.ep1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | jboss-remoting | 0 | 0:2.2.3-3.SP2.ep1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | jboss-seam | 0 | 0:1.2.1-1.ep1.24.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | jboss-seam-docs | 0 | 0:1.2.1-1.ep1.24.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | jbossas | 0 | 0:4.2.0-6.GA_CP09.6.ep1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | jbossas-4.2.0.GA_CP09-bin | 0 | 0:4.2.0-6.GA_CP09.6.ep1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | jbossas-client | 0 | 0:4.2.0-6.GA_CP09.6.ep1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | jbossts | 0 | 1:4.2.3-1.SP5_CP09.1jpp.ep1.1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | jbossweb | 0 | 0:2.0.0-6.CP13.0jpp.ep1.1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | rh-eap-docs | 0 | 0:4.2.0-7.GA_CP09.ep1.4.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | rh-eap-docs-examples | 0 | 0:4.2.0-7.GA_CP09.ep1.4.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | hibernate3 | 0 | 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | hibernate3-annotations | 0 | 0:3.3.1-1.12.GA_CP03.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | hibernate3-annotations-javadoc | 0 | 0:3.3.1-1.12.GA_CP03.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | hibernate3-javadoc | 0 | 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | hsqldb | 0 | 1:1.8.0.8-3.patch03.1jpp.ep1.3.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jacorb | 0 | 0:2.3.0-1jpp.ep1.10.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jakarta-commons-httpclient | 0 | 1:3.0.1-1.patch01.1jpp.ep1.4.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jboss-aop | 0 | 0:1.5.5-3.CP05.2.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jboss-cache | 0 | 0:1.4.1-6.SP14.1.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jboss-messaging | 0 | 0:1.4.0-3.SP3_CP10.2.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jboss-remoting | 0 | 0:2.2.3-3.SP2.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jboss-seam | 0 | 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jboss-seam-docs | 0 | 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jboss-seam2 | 0 | 0:2.0.2.FP-1.ep1.23.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jboss-seam2-docs | 0 | 0:2.0.2.FP-1.ep1.23.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jbossas | 0 | 0:4.3.0-7.GA_CP08.5.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jbossas-4.3.0.GA_CP08-bin | 0 | 0:4.3.0-7.GA_CP08.5.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jbossas-client | 0 | 0:4.3.0-7.GA_CP08.5.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jbossts | 0 | 1:4.2.3-1.SP5_CP09.1jpp.ep1.1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jbossweb | 0 | 0:2.0.0-6.CP13.0jpp.ep1.1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jbossws | 0 | 0:2.0.1-5.SP2_CP08.1.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | rh-eap-docs | 0 | 0:4.3.0-7.GA_CP08.ep1.6.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | rh-eap-docs-examples | 0 | 0:4.3.0-7.GA_CP08.ep1.6.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | hibernate3 | 0 | 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | hibernate3-annotations | 0 | 0:3.3.1-1.12.GA_CP03.ep1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | hibernate3-annotations-javadoc | 0 | 0:3.3.1-1.12.GA_CP03.ep1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | hibernate3-javadoc | 0 | 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jacorb | 0 | 0:2.3.0-1jpp.ep1.10.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jboss-aop | 0 | 0:1.5.5-3.CP05.2.ep1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jboss-cache | 0 | 0:1.4.1-6.SP14.1.ep1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jboss-messaging | 0 | 0:1.4.0-3.SP3_CP10.2.ep1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jboss-remoting | 0 | 0:2.2.3-3.SP2.ep1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jboss-seam | 0 | 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el5.1 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jboss-seam-docs | 0 | 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el5.1 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jboss-seam2 | 0 | 0:2.0.2.FP-1.ep1.23.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jboss-seam2-docs | 0 | 0:2.0.2.FP-1.ep1.23.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jbossas | 0 | 0:4.3.0-7.GA_CP08.5.ep1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jbossas-4.3.0.GA_CP08-bin | 0 | 0:4.3.0-7.GA_CP08.5.ep1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jbossas-client | 0 | 0:4.3.0-7.GA_CP08.5.ep1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jbossts | 0 | 1:4.2.3-1.SP5_CP09.1jpp.ep1.1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jbossweb | 0 | 0:2.0.0-6.CP13.0jpp.ep1.1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jbossws | 0 | 0:2.0.1-5.SP2_CP08.1.ep1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | rh-eap-docs | 0 | 0:4.3.0-7.GA_CP08.ep1.5.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | rh-eap-docs-examples | 0 | 0:4.3.0-7.GA_CP08.ep1.5.el5 |
Related vulnerabilities
- CVE-2010-0738 The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application… Also affects hibernate3
- CVE-2010-1429 Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before… Also affects hibernate3
- CVE-2009-2625 XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in… Also affects hibernate3
- CVE-2008-5515 Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and… Also affects hibernate3
- CVE-2009-0580 Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when… Also affects hibernate3
- CVE-2008-3273 JBoss Enterprise Application Platform (aka JBossEAP or EAP) before 4.2.0.CP03, and 4.3.0… Also affects hibernate3
- CVE-2007-5461 Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0… Also affects hibernate3
- CVE-2010-4476 The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and… Also affects jbossweb