CVE-2010-1429
NoneCVSS
—
EPSS
53.7%
Published
Apr 28, 2010
CISA due date
—
The record
Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 allows remote attackers to obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string. NOTE: this issue exists because of a CVE-2008-3273 regression.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | hibernate3 | 0 | 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | hibernate3-annotations | 0 | 0:3.3.1-1.12.GA_CP03.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | hibernate3-annotations-javadoc | 0 | 0:3.3.1-1.12.GA_CP03.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | hibernate3-javadoc | 0 | 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | hsqldb | 0 | 1:1.8.0.8-3.patch03.1jpp.ep1.3.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | jacorb | 0 | 0:2.3.0-1jpp.ep1.10.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | jakarta-commons-httpclient | 0 | 1:3.0.1-1.patch01.1jpp.ep1.4.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | jboss-aop | 0 | 0:1.5.5-3.CP05.2.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | jboss-cache | 0 | 0:1.4.1-6.SP14.1.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | jboss-remoting | 0 | 0:2.2.3-3.SP2.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | jboss-seam | 0 | 0:1.2.1-1.ep1.24.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | jboss-seam-docs | 0 | 0:1.2.1-1.ep1.24.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | jbossas | 0 | 0:4.2.0-6.GA_CP09.6.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | jbossas-4.2.0.GA_CP09-bin | 0 | 0:4.2.0-6.GA_CP09.6.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | jbossas-client | 0 | 0:4.2.0-6.GA_CP09.6.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | jbossts | 0 | 1:4.2.3-1.SP5_CP09.1jpp.ep1.1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | jbossweb | 0 | 0:2.0.0-6.CP13.0jpp.ep1.1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | rh-eap-docs | 0 | 0:4.2.0-7.GA_CP09.ep1.5.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | rh-eap-docs-examples | 0 | 0:4.2.0-7.GA_CP09.ep1.5.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | hibernate3 | 0 | 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | hibernate3-annotations | 0 | 0:3.3.1-1.12.GA_CP03.ep1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | hibernate3-annotations-javadoc | 0 | 0:3.3.1-1.12.GA_CP03.ep1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | hibernate3-javadoc | 0 | 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | jacorb | 0 | 0:2.3.0-1jpp.ep1.10.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | jboss-aop | 0 | 0:1.5.5-3.CP05.2.ep1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | jboss-cache | 0 | 0:1.4.1-6.SP14.1.ep1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | jboss-remoting | 0 | 0:2.2.3-3.SP2.ep1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | jboss-seam | 0 | 0:1.2.1-1.ep1.24.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | jboss-seam-docs | 0 | 0:1.2.1-1.ep1.24.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | jbossas | 0 | 0:4.2.0-6.GA_CP09.6.ep1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | jbossas-4.2.0.GA_CP09-bin | 0 | 0:4.2.0-6.GA_CP09.6.ep1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | jbossas-client | 0 | 0:4.2.0-6.GA_CP09.6.ep1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | jbossts | 0 | 1:4.2.3-1.SP5_CP09.1jpp.ep1.1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | jbossweb | 0 | 0:2.0.0-6.CP13.0jpp.ep1.1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | rh-eap-docs | 0 | 0:4.2.0-7.GA_CP09.ep1.4.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | rh-eap-docs-examples | 0 | 0:4.2.0-7.GA_CP09.ep1.4.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | hibernate3 | 0 | 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | hibernate3-annotations | 0 | 0:3.3.1-1.12.GA_CP03.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | hibernate3-annotations-javadoc | 0 | 0:3.3.1-1.12.GA_CP03.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | hibernate3-javadoc | 0 | 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | hsqldb | 0 | 1:1.8.0.8-3.patch03.1jpp.ep1.3.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jacorb | 0 | 0:2.3.0-1jpp.ep1.10.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jakarta-commons-httpclient | 0 | 1:3.0.1-1.patch01.1jpp.ep1.4.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jboss-aop | 0 | 0:1.5.5-3.CP05.2.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jboss-cache | 0 | 0:1.4.1-6.SP14.1.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jboss-messaging | 0 | 0:1.4.0-3.SP3_CP10.2.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jboss-remoting | 0 | 0:2.2.3-3.SP2.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jboss-seam | 0 | 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jboss-seam-docs | 0 | 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jboss-seam2 | 0 | 0:2.0.2.FP-1.ep1.23.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jboss-seam2-docs | 0 | 0:2.0.2.FP-1.ep1.23.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jbossas | 0 | 0:4.3.0-7.GA_CP08.5.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jbossas-4.3.0.GA_CP08-bin | 0 | 0:4.3.0-7.GA_CP08.5.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jbossas-client | 0 | 0:4.3.0-7.GA_CP08.5.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jbossts | 0 | 1:4.2.3-1.SP5_CP09.1jpp.ep1.1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jbossweb | 0 | 0:2.0.0-6.CP13.0jpp.ep1.1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jbossws | 0 | 0:2.0.1-5.SP2_CP08.1.ep1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | rh-eap-docs | 0 | 0:4.3.0-7.GA_CP08.ep1.6.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | rh-eap-docs-examples | 0 | 0:4.3.0-7.GA_CP08.ep1.6.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | hibernate3 | 0 | 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | hibernate3-annotations | 0 | 0:3.3.1-1.12.GA_CP03.ep1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | hibernate3-annotations-javadoc | 0 | 0:3.3.1-1.12.GA_CP03.ep1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | hibernate3-javadoc | 0 | 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jacorb | 0 | 0:2.3.0-1jpp.ep1.10.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jboss-aop | 0 | 0:1.5.5-3.CP05.2.ep1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jboss-cache | 0 | 0:1.4.1-6.SP14.1.ep1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jboss-messaging | 0 | 0:1.4.0-3.SP3_CP10.2.ep1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jboss-remoting | 0 | 0:2.2.3-3.SP2.ep1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jboss-seam | 0 | 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el5.1 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jboss-seam-docs | 0 | 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el5.1 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jboss-seam2 | 0 | 0:2.0.2.FP-1.ep1.23.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jboss-seam2-docs | 0 | 0:2.0.2.FP-1.ep1.23.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jbossas | 0 | 0:4.3.0-7.GA_CP08.5.ep1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jbossas-4.3.0.GA_CP08-bin | 0 | 0:4.3.0-7.GA_CP08.5.ep1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jbossas-client | 0 | 0:4.3.0-7.GA_CP08.5.ep1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jbossts | 0 | 1:4.2.3-1.SP5_CP09.1jpp.ep1.1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jbossweb | 0 | 0:2.0.0-6.CP13.0jpp.ep1.1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jbossws | 0 | 0:2.0.1-5.SP2_CP08.1.ep1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | rh-eap-docs | 0 | 0:4.3.0-7.GA_CP08.ep1.5.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | rh-eap-docs-examples | 0 | 0:4.3.0-7.GA_CP08.ep1.5.el5 |
Related vulnerabilities
- CVE-2010-1428 The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application… Also affects hibernate3
- CVE-2010-0738 The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application… Also affects hibernate3
- CVE-2009-2625 XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in… Also affects hibernate3
- CVE-2008-5515 Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and… Also affects hibernate3
- CVE-2009-0580 Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when… Also affects hibernate3
- CVE-2008-3273 JBoss Enterprise Application Platform (aka JBossEAP or EAP) before 4.2.0.CP03, and 4.3.0… Also affects hibernate3
- CVE-2007-5461 Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0… Also affects hibernate3
- CVE-2010-4476 The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and… Also affects jbossweb