CVE-2008-3273: Medium severity jboss enterprise application platform vulnerability
Published Aug 4, 2008
·Updated
JBoss Enterprise Application Platform (aka JBossEAP or EAP) before 4.2.0.CP03, and 4.3.0 before 4.3.0.CP01, allows remote attackers to obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string.
Other sources
The status servlet exposes details about the deployed servlets and makes it easier to identity the attack surface of an EAP installation.
http://host:8080/status?full=true
Affected Software
245 affected componentsFixes available
redhat/glassfish-javamail<0:1.4.0-0jpp.ep1.9.el4
0:1.4.0-0jpp.ep1.9.el4
redhat/hibernate3<1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el4
1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el4
redhat/hibernate3-annotations<0:3.2.1-1.patch02.1jpp.ep1.3.el4
0:3.2.1-1.patch02.1jpp.ep1.3.el4
redhat/jbossas<0:4.2.0-3.GA_CP03.ep1.9.el4
0:4.2.0-3.GA_CP03.ep1.9.el4
redhat/jboss-cache<0:1.4.1-4.SP9.1jpp.ep1.1.el4
0:1.4.1-4.SP9.1jpp.ep1.1.el4
redhat/jboss-remoting<0:2.2.2-3.SP7.0jpp.ep1.3.el4
0:2.2.2-3.SP7.0jpp.ep1.3.el4
redhat/jboss-seam<0:1.2.1-1.ep1.7.el4
0:1.2.1-1.ep1.7.el4
redhat/jbossts<1:4.2.3-1.SP5_CP01.1jpp.ep1.1.el4
1:4.2.3-1.SP5_CP01.1jpp.ep1.1.el4
redhat/jcommon<0:1.0.12-1jpp.ep1.3.el4
0:1.0.12-1jpp.ep1.3.el4
redhat/jfreechart<0:1.0.9-1jpp.ep1.3.el4
0:1.0.9-1jpp.ep1.3.el4
redhat/rh-eap-docs<0:4.2.0-3.GA_CP03.ep1.5.el4
0:4.2.0-3.GA_CP03.ep1.5.el4
redhat/hibernate3<1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el5
1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el5
redhat/hibernate3-annotations<0:3.2.1-1.patch02.1jpp.ep1.3.el5.1
0:3.2.1-1.patch02.1jpp.ep1.3.el5.1
redhat/jbossas<0:4.2.0-4.GA_CP03.ep1.8.el5.1
0:4.2.0-4.GA_CP03.ep1.8.el5.1
redhat/jboss-cache<0:1.4.1-4.SP9.1jpp.ep1.1.el5
0:1.4.1-4.SP9.1jpp.ep1.1.el5
redhat/jboss-remoting<0:2.2.2-3.SP7.0jpp.ep1.3.el5
0:2.2.2-3.SP7.0jpp.ep1.3.el5
redhat/jboss-seam<0:1.2.1-1.ep1.6.el5
0:1.2.1-1.ep1.6.el5
redhat/jbossts<1:4.2.3-1.SP5_CP01.1jpp.ep1.1.el5
1:4.2.3-1.SP5_CP01.1jpp.ep1.1.el5
redhat/jcommon<0:1.0.12-1jpp.ep1.3.el5
0:1.0.12-1jpp.ep1.3.el5
redhat/jfreechart<0:1.0.9-1jpp.ep1.3.el5.1
0:1.0.9-1jpp.ep1.3.el5.1
redhat/rh-eap-docs<0:4.2.0-3.GA_CP03.ep1.5.el5
0:4.2.0-3.GA_CP03.ep1.5.el5
redhat/antlr<0:2.7.6-6.2.2.jdk6.ep5.el5
0:2.7.6-6.2.2.jdk6.ep5.el5
redhat/apache-cxf<0:2.2.6-1.patch_01.7.jdk6.ep5.el5
0:2.2.6-1.patch_01.7.jdk6.ep5.el5
redhat/apache-james<0:0.6-5.2.1.jdk6.ep5.el5
0:0.6-5.2.1.jdk6.ep5.el5
redhat/avalon-framework<0:4.1.5-2.2.1.jdk6.ep5.el5
0:4.1.5-2.2.1.jdk6.ep5.el5
redhat/avalon-logkit<0:1.2-4.3.1.jdk6.ep5.el5
0:1.2-4.3.1.jdk6.ep5.el5
redhat/bcel<0:5.1-16.2.1.2.jdk6.ep5.el5
0:5.1-16.2.1.2.jdk6.ep5.el5
redhat/bsf<0:2.4.0-2.2.2.jdk6.ep5.el5
0:2.4.0-2.2.2.jdk6.ep5.el5
redhat/bsh<0:1.3.0-13.2.2.jdk6.ep5.el5
0:1.3.0-13.2.2.jdk6.ep5.el5
redhat/cglib<0:2.2-5.1.1.1.jdk6.ep5.el5
0:2.2-5.1.1.1.jdk6.ep5.el5
redhat/codehaus-jackson<0:1.3.5-0.1.jdk6.ep5.el5
0:1.3.5-0.1.jdk6.ep5.el5
redhat/codehaus-stax11<0:1.1.2-4.2.3.jdk6.ep5.el5
0:1.1.2-4.2.3.jdk6.ep5.el5
redhat/concurrent<0:1.3.4-10.1.1.jdk6.ep5.el5
0:1.3.4-10.1.1.jdk6.ep5.el5
redhat/dom4j<0:1.6.1-10.4.1.jdk6.ep5.el5
0:1.6.1-10.4.1.jdk6.ep5.el5
redhat/dtdparser<0:1.21-6.1.4.1.jdk6.ep5.el5
0:1.21-6.1.4.1.jdk6.ep5.el5
redhat/ecj3<1:3.3.1.1-3.1.1.1.jdk6.ep5.el5
1:3.3.1.1-3.1.1.1.jdk6.ep5.el5
redhat/facelets<0:1.1.15-0.b1.4.jdk6.ep5.el5
0:1.1.15-0.b1.4.jdk6.ep5.el5
redhat/glassfish-jaf<0:1.1.0-6.2.1.jdk6.ep5.el5
0:1.1.0-6.2.1.jdk6.ep5.el5
redhat/glassfish-javamail<0:1.4.2-0.3.2.jdk6.ep5.el5
0:1.4.2-0.3.2.jdk6.ep5.el5
redhat/glassfish-jaxb<0:2.1.12-5.jdk6.ep5.el5
0:2.1.12-5.jdk6.ep5.el5
redhat/glassfish-jaxws<0:2.1.7-0.20.jdk6.ep5.el5
0:2.1.7-0.20.jdk6.ep5.el5
redhat/glassfish-jsf<0:1.2_13-3.1.1.jdk6.ep5.el5
0:1.2_13-3.1.1.jdk6.ep5.el5
redhat/glassfish-jstl<0:1.2.0-10.6.jdk6.ep5.el5
0:1.2.0-10.6.jdk6.ep5.el5
redhat/gnu-getopt<0:1.0.13-1.1.2.jdk6.ep5.el5
0:1.0.13-1.1.2.jdk6.ep5.el5
redhat/gnu-trove<0:1.0.2-7.1.1.jdk6.ep5.el5
0:1.0.2-7.1.1.jdk6.ep5.el5
redhat/hibernate3<1:3.3.2-1.1.GA_CP03.jdk6.ep5.el5
1:3.3.2-1.1.GA_CP03.jdk6.ep5.el5
redhat/hibernate3-annotations<0:3.4.0-3.1.GA_CP03.jdk6.ep5.el5
0:3.4.0-3.1.GA_CP03.jdk6.ep5.el5
redhat/hibernate3-commons-annotations<0:3.1.0-1.7.jdk6.ep5.el5
0:3.1.0-1.7.jdk6.ep5.el5
redhat/hibernate3-ejb-persistence<3.0-api-1:1.0.2-3.1.jdk6.ep5.el5
3.0-api-1:1.0.2-3.1.jdk6.ep5.el5
redhat/hibernate3-entitymanager<0:3.4.0-4.1.GA_CP03.jdk6.ep5.el5
0:3.4.0-4.1.GA_CP03.jdk6.ep5.el5
redhat/hibernate3-search<0:3.1.1-2.2.GA_CP03.jdk6.ep5.el5
0:3.1.1-2.2.GA_CP03.jdk6.ep5.el5
redhat/hibernate3-validator<0:3.1.0-1.5.2.jdk6.ep5.el5
0:3.1.0-1.5.2.jdk6.ep5.el5
redhat/hornetq-jopr-plugin<0:1.0.0-0.CR2.0.jdk6.ep5.el5
0:1.0.0-0.CR2.0.jdk6.ep5.el5
redhat/hsqldb<1:1.8.0.8-3.patch03.2.ep5.el5
1:1.8.0.8-3.patch03.2.ep5.el5
redhat/i18nlog<0:1.0.10-2.jdk6.ep5.el5
0:1.0.10-2.jdk6.ep5.el5
redhat/icu4j<0:3.4.5-2.3.1.jdk6.ep5.el5
0:3.4.5-2.3.1.jdk6.ep5.el5
redhat/isorelax<1:0-0.4.release20050331.2.1.jdk6.ep5.el5
1:0-0.4.release20050331.2.1.jdk6.ep5.el5
redhat/jacorb-jboss<0:2.3.1-8.1.jdk6.ep5.el5
0:2.3.1-8.1.jdk6.ep5.el5
redhat/jakarta-commons-beanutils<0:1.8.0-4.1.2.1.jdk6.ep5.el5
0:1.8.0-4.1.2.1.jdk6.ep5.el5
redhat/jakarta-commons-codec<0:1.3-9.2.1.1.jdk6.ep5.el5
0:1.3-9.2.1.1.jdk6.ep5.el5
redhat/jakarta-commons-collections<0:3.2-3.5.1.jdk6.ep5.el5
0:3.2-3.5.1.jdk6.ep5.el5
redhat/jakarta-commons-dbcp<0:1.2.1-16.1.jdk6.ep5.el5
0:1.2.1-16.1.jdk6.ep5.el5
redhat/jakarta-commons-digester<0:1.8.1-8.1.jdk6.ep5.el5
0:1.8.1-8.1.jdk6.ep5.el5
redhat/jakarta-commons-discovery<1:0.4-6.1.1.jdk6.ep5.el5
1:0.4-6.1.1.jdk6.ep5.el5
redhat/jakarta-commons-el<0:1.0-19.2.jdk6.ep5.el5
0:1.0-19.2.jdk6.ep5.el5
redhat/jakarta-commons-httpclient<1:3.1-1.2.1.jdk6.ep5.el5
1:3.1-1.2.1.jdk6.ep5.el5
redhat/jakarta-commons-io<0:1.4-1.3.1.jdk6.ep5.el5
0:1.4-1.3.1.jdk6.ep5.el5
redhat/jakarta-commons-lang<0:2.4-1.3.1.jdk6.ep5.el5
0:2.4-1.3.1.jdk6.ep5.el5
redhat/jakarta-commons-logging<0:1.1.1-0.4.1.jdk6.ep5.el5
0:1.1.1-0.4.1.jdk6.ep5.el5
redhat/jakarta-commons-logging-jboss<0:1.1-10.2.1.jdk6.ep5.el5
0:1.1-10.2.1.jdk6.ep5.el5
redhat/jakarta-commons-parent<0:11-2.1.jdk6.ep5.el5
0:11-2.1.jdk6.ep5.el5
redhat/jakarta-commons-pool<0:1.3-11.2.1.jdk6.ep5.el5
0:1.3-11.2.1.jdk6.ep5.el5
redhat/jakarta-commons-transaction<0:1.1-3.2.1.1.jdk6.ep5.el5
0:1.1-3.2.1.1.jdk6.ep5.el5
redhat/jakarta-oro<0:2.0.8-3.3.2.1.1.1.jdk6.ep5.el5
0:2.0.8-3.3.2.1.1.1.jdk6.ep5.el5
redhat/jakarta-slide-webdavclient<0:2.1-9.5.1.jdk6.ep5.el5
0:2.1-9.5.1.jdk6.ep5.el5
redhat/javacc<0:4.0-6.1.jdk6.ep5.el5
0:4.0-6.1.jdk6.ep5.el5
redhat/javassist<0:3.12.0-1.jdk6.ep5.el5
0:3.12.0-1.jdk6.ep5.el5
redhat/jaxbintros<0:1.0.0-1.1.3.2.jdk6.ep5.el5
0:1.0.0-1.1.3.2.jdk6.ep5.el5
redhat/jaxen<0:1.1.2-5.1.jdk6.ep5.el5
0:1.1.2-5.1.jdk6.ep5.el5
redhat/jboss5-libs<0:5.1.0-1.3.2.1.jdk6.ep5.el5
0:5.1.0-1.3.2.1.jdk6.ep5.el5
redhat/jboss-aop2<0:2.1.6-1.CP01.1.1.jdk6.ep5.el5
0:2.1.6-1.CP01.1.1.jdk6.ep5.el5
redhat/jboss-aspects-common<0:1.0.0-0.b1.1.2.1.1.jdk6.ep5.el5
0:1.0.0-0.b1.1.2.1.1.jdk6.ep5.el5
redhat/jbossas-web<0:5.1.0-52.jdk6.ep5.el5
0:5.1.0-52.jdk6.ep5.el5
redhat/jbossas-ws-cxf-ewp<0:5.1.0-7.jdk6.ep5.el5
0:5.1.0-7.jdk6.ep5.el5
redhat/jboss-bootstrap<0:1.0.1-2.1.1.jdk6.ep5.el5
0:1.0.1-2.1.1.jdk6.ep5.el5
redhat/jboss-cache-core<0:3.2.5-4.jdk6.ep5.el5
0:3.2.5-4.jdk6.ep5.el5
redhat/jboss-cache-pojo<0:3.0.0-4.5.1.1.jdk6.ep5.el5
0:3.0.0-4.5.1.1.jdk6.ep5.el5
redhat/jboss-cl<0:2.0.9-1.jdk6.ep5.el5
0:2.0.9-1.jdk6.ep5.el5
redhat/jboss-cluster-ha-client<0:1.1.1-1.3.1.jdk6.ep5.el5
0:1.1.1-1.3.1.jdk6.ep5.el5
redhat/jboss-cluster-ha-server-api<0:1.1.3-1.jdk6.ep5.el5
0:1.1.3-1.jdk6.ep5.el5
redhat/jboss-cluster-ha-server-cache-jbc<0:2.0.3-1.jdk6.ep5.el5
0:2.0.3-1.jdk6.ep5.el5
redhat/jboss-cluster-ha-server-cache-spi<0:2.0.0-2.3.1.jdk6.ep5.el5
0:2.0.0-2.3.1.jdk6.ep5.el5
redhat/jboss-common-core<0:2.2.16-3.jdk6.ep5.el5
0:2.2.16-3.jdk6.ep5.el5
redhat/jboss-common-logging-jdk<0:2.1.1-1.1.1.jdk6.ep5.el5
0:2.1.1-1.1.1.jdk6.ep5.el5
redhat/jboss-common-logging-log4j<0:2.1.1-1.1.jdk6.ep5.el5
0:2.1.1-1.1.jdk6.ep5.el5
redhat/jboss-common-logging-spi<0:2.1.1-1.1.jdk6.ep5.el5
0:2.1.1-1.1.jdk6.ep5.el5
redhat/jboss-current-invocation-aspects<0:1.0.1-1.5.1.jdk6.ep5.el5
0:1.0.1-1.5.1.jdk6.ep5.el5
redhat/jboss-deployers<0:2.0.10-1.jdk6.ep5.el5
0:2.0.10-1.jdk6.ep5.el5
redhat/jboss-eap5-native<0:5.1.0-12.1.jdk6.ep5.el5
0:5.1.0-12.1.jdk6.ep5.el5
redhat/jboss-ejb3-build<0:1.0.13-0.2.jdk6.ep5.el5
0:1.0.13-0.2.jdk6.ep5.el5
redhat/jboss-ejb3-cache<0:1.0.0-3.4.1.jdk6.ep5.el5
0:1.0.0-3.4.1.jdk6.ep5.el5
redhat/jboss-ejb3-common<0:1.0.2-0.2.jdk6.ep5.el5
0:1.0.2-0.2.jdk6.ep5.el5
redhat/jboss-ejb3-context<0:0.1.1-0.4.jdk6.ep5.el5
0:0.1.1-0.4.jdk6.ep5.el5
redhat/jboss-ejb3-core<0:1.3.6-0.1.jdk6.ep5.el5
0:1.3.6-0.1.jdk6.ep5.el5
redhat/jboss-ejb3-deployers<0:1.1.4-0.3.jdk6.ep5.el5
0:1.1.4-0.3.jdk6.ep5.el5
redhat/jboss-ejb3-endpoint<0:0.1.0-2.4.1.jdk6.ep5.el5
0:0.1.0-2.4.1.jdk6.ep5.el5
redhat/jboss-ejb3-endpoint-deployer<0:0.1.4-1.3.1.1.1.jdk6.ep5.el5
0:0.1.4-1.3.1.1.1.jdk6.ep5.el5
redhat/jboss-ejb3-ext-api<0:1.0.0-3.5.1.1.jdk6.ep5.el5
0:1.0.0-3.5.1.1.jdk6.ep5.el5
redhat/jboss-ejb3-ext-api-impl<0:1.0.0-3.4.1.jdk6.ep5.el5
0:1.0.0-3.4.1.jdk6.ep5.el5
redhat/jboss-ejb3-interceptors<0:1.0.7-0.3.jdk6.ep5.el5
0:1.0.7-0.3.jdk6.ep5.el5
redhat/jboss-ejb3-jpa-int<0:1.0.0-1.1.1.1.jdk6.ep5.el5
0:1.0.0-1.1.1.1.jdk6.ep5.el5
redhat/jboss-ejb3-mc-int<0:1.0.2-1.1.1.jdk6.ep5.el5
0:1.0.2-1.1.1.jdk6.ep5.el5
redhat/jboss-ejb3-metadata<0:1.0.0-2.4.1.1.jdk6.ep5.el5
0:1.0.0-2.4.1.1.jdk6.ep5.el5
redhat/jboss-ejb3-metrics-deployer<0:1.1.0-0.2.jdk6.ep5.el5
0:1.1.0-0.2.jdk6.ep5.el5
redhat/jboss-ejb3-proxy-clustered<0:1.0.3-1.1.1.1.jdk6.ep5.el5
0:1.0.3-1.1.1.1.jdk6.ep5.el5
redhat/jboss-ejb3-proxy-impl<0:1.0.6-1.1.1.1.jdk6.ep5.el5
0:1.0.6-1.1.1.1.jdk6.ep5.el5
redhat/jboss-ejb3-proxy-spi<0:1.0.0-1.3.1.1.jdk6.ep5.el5
0:1.0.0-1.3.1.1.jdk6.ep5.el5
redhat/jboss-ejb3-security<0:1.0.2-0.2.jdk6.ep5.el5
0:1.0.2-0.2.jdk6.ep5.el5
redhat/jboss-ejb3-timeout<0:0.1.1-0.4.jdk6.ep5.el5
0:0.1.1-0.4.jdk6.ep5.el5
redhat/jboss-ejb3-timerservice-spi<0:1.0.0-1.4.1.jdk6.ep5.el5
0:1.0.0-1.4.1.jdk6.ep5.el5
redhat/jboss-ejb3-transactions<0:1.0.2-1.3.1.2.1.jdk6.ep5.el5
0:1.0.2-1.3.1.2.1.jdk6.ep5.el5
redhat/jboss-ejb3-vfs<0:1.0.0-0.alpha1.0.2.jdk6.ep5.el5
0:1.0.0-0.alpha1.0.2.jdk6.ep5.el5
redhat/jboss-el<0:1.0_02-0.CR5.2.jdk6.ep5.el5
0:1.0_02-0.CR5.2.jdk6.ep5.el5
redhat/jboss-integration<0:5.1.0-2.SP1.4.1.1.jdk6.ep5.el5
0:5.1.0-2.SP1.4.1.1.jdk6.ep5.el5
redhat/jboss-javaee<0:5.0.1-2.6.jdk6.ep5.el5
0:5.0.1-2.6.jdk6.ep5.el5
redhat/jboss-jaxr<0:2.0.1-6.jdk6.ep5.el5
0:2.0.1-6.jdk6.ep5.el5
redhat/jboss-jpa-deployers<0:1.0.0-1.3.2.jdk6.ep5.el5
0:1.0.0-1.3.2.jdk6.ep5.el5
redhat/jboss-logbridge<0:1.0.0-3.1.jdk6.ep5.el5
0:1.0.0-3.1.jdk6.ep5.el5
redhat/jboss-logmanager<0:1.1.0-2.1.1.jdk6.ep5.el5
0:1.1.0-2.1.1.jdk6.ep5.el5
redhat/jboss-man<0:2.1.1-4.SP2.1.1.jdk6.ep5.el5
0:2.1.1-4.SP2.1.1.jdk6.ep5.el5
redhat/jboss-mdr<0:2.0.2-3.2.1.jdk6.ep5.el5
0:2.0.2-3.2.1.jdk6.ep5.el5
redhat/jboss-metadata<0:1.0.6-1.jdk6.ep5.el5
0:1.0.6-1.jdk6.ep5.el5
redhat/jboss-microcontainer2<0:2.0.10-3.jdk6.ep5.el5
0:2.0.10-3.jdk6.ep5.el5
redhat/jboss-naming<0:5.0.3-2.2.1.jdk6.ep5.el5
0:5.0.3-2.2.1.jdk6.ep5.el5
redhat/jboss-parent<0:4.0-1.1.jdk6.ep5.el5
0:4.0-1.1.jdk6.ep5.el5
redhat/jboss-reflect<0:2.0.3-4.jdk6.ep5.el5
0:2.0.3-4.jdk6.ep5.el5
redhat/jboss-remoting<0:2.5.3-4.SP1.3.jdk6.ep5.el5
0:2.5.3-4.SP1.3.jdk6.ep5.el5
redhat/jboss-remoting-aspects<0:1.0.3-0.3.jdk6.ep5.el5
0:1.0.3-0.3.jdk6.ep5.el5
redhat/jboss-seam2<0:2.2.2.EAP-14.jdk6.ep5.el5
0:2.2.2.EAP-14.jdk6.ep5.el5
redhat/jboss-seam-int<0:5.1.0-1.jdk6.ep5.el5
0:5.1.0-1.jdk6.ep5.el5
redhat/jboss-security-aspects<0:1.0.0-2.2.1.jdk6.ep5.el5
0:1.0.0-2.2.1.jdk6.ep5.el5
redhat/jboss-security-negotiation<0:2.0.3-2.SP3.2.jdk6.ep5.el5
0:2.0.3-2.SP3.2.jdk6.ep5.el5
redhat/jboss-security-spi<1:2.0.4-4.SP4.1.jdk6.ep5.el5
1:2.0.4-4.SP4.1.jdk6.ep5.el5
redhat/jboss-security-xacml<0:2.0.4-4.1.1.jdk6.ep5.el5
0:2.0.4-4.1.1.jdk6.ep5.el5
redhat/jboss-serialization<0:1.0.4-0.3.jdk6.ep5.el5
0:1.0.4-0.3.jdk6.ep5.el5
redhat/jbosssx2<0:2.0.4-4.SP4.1.jdk6.ep5.el5
0:2.0.4-4.SP4.1.jdk6.ep5.el5
redhat/jboss-threads<0:1.0.0-2.2.1.jdk6.ep5.el5
0:1.0.0-2.2.1.jdk6.ep5.el5
redhat/jboss-transaction-aspects<0:1.0.0-1.4.1.1.jdk6.ep5.el5
0:1.0.0-1.4.1.1.jdk6.ep5.el5
redhat/jbossts<1:4.6.1-5.CP07.1.1.jdk6.ep5.el5
1:4.6.1-5.CP07.1.1.jdk6.ep5.el5
redhat/jboss-vfs2<0:2.2.0-2.jdk6.ep5.el5
0:2.2.0-2.jdk6.ep5.el5
redhat/jbossweb<0:2.1.10-4.1.jdk6.ep5.el5
0:2.1.10-4.1.jdk6.ep5.el5
redhat/jbossws<0:3.1.2-4.SP7.1.1.jdk6.ep5.el5
0:3.1.2-4.SP7.1.1.jdk6.ep5.el5
redhat/jbossws-common<0:1.1.0-2.SP6.1.jdk6.ep5.el5
0:1.1.0-2.SP6.1.jdk6.ep5.el5
redhat/jbossws-framework<0:3.1.2-4.SP8.1.1.jdk6.ep5.el5
0:3.1.2-4.SP8.1.1.jdk6.ep5.el5
redhat/jbossws-parent<0:1.0.8-1.jdk6.ep5.el5
0:1.0.8-1.jdk6.ep5.el5
redhat/jbossws-spi<0:1.1.2-3.SP4.1.jdk6.ep5.el5
0:1.1.2-3.SP4.1.jdk6.ep5.el5
redhat/jbossxb2<0:2.0.1-5.jdk6.ep5.el5
0:2.0.1-5.jdk6.ep5.el5
redhat/jboss-xnio-base<0:1.2.1-3.1.jdk6.ep5.el5
0:1.2.1-3.1.jdk6.ep5.el5
redhat/jboss-xnio-metadata<0:1.0.1-1.3.1.jdk6.ep5.el5
0:1.0.1-1.3.1.jdk6.ep5.el5
redhat/jcip-annotations<0:1.0-2.2.1.jdk6.ep5.el5
0:1.0-2.2.1.jdk6.ep5.el5
redhat/jcommon<0:1.0.16-1.2.1.jdk6.ep5.el5
0:1.0.16-1.2.1.jdk6.ep5.el5
redhat/jdom<0:1.0-4.4.jdk6.ep5.el5
0:1.0-4.4.jdk6.ep5.el5
redhat/jettison<0:1.1-1.4.jdk6.ep5.el5
0:1.1-1.4.jdk6.ep5.el5
redhat/jfreechart<0:1.0.13-2.3.2.1.jdk6.ep5.el5
0:1.0.13-2.3.2.1.jdk6.ep5.el5
redhat/jgroups<1:2.6.16-2.jdk6.ep5.el5
1:2.6.16-2.jdk6.ep5.el5
redhat/joda-time<0:1.5.2-3.1.jdk6.ep5.el5
0:1.5.2-3.1.jdk6.ep5.el5
redhat/joesnmp<0:0.3.4-3.1.jdk6.ep5.el5
0:0.3.4-3.1.jdk6.ep5.el5
redhat/jopr-embedded<0:1.3.4-16.SP1.5.jdk6.ep5.el5
0:1.3.4-16.SP1.5.jdk6.ep5.el5
redhat/jopr-hibernate-plugin<0:3.0.0-8.EmbJopr2.jdk6.ep5.el5
0:3.0.0-8.EmbJopr2.jdk6.ep5.el5
redhat/jopr-jboss-as<5-plugin-0:3.0.0-7.EmbJopr2.jdk6.ep5.el5
5-plugin-0:3.0.0-7.EmbJopr2.jdk6.ep5.el5
redhat/jopr-jboss-cache-v3-plugin<0:3.0.0-6.EmbJopr2.jdk6.ep5.el5
0:3.0.0-6.EmbJopr2.jdk6.ep5.el5
redhat/juddi<0:2.0.1-2.1.jdk6.ep5.el5
0:2.0.1-2.1.jdk6.ep5.el5
redhat/jyaml<0:1.3-3.1.jdk6.ep5.el5
0:1.3-3.1.jdk6.ep5.el5
redhat/log4j<0:1.2.14-18.1.jdk6.ep5.el5
0:1.2.14-18.1.jdk6.ep5.el5
redhat/mockobjects<0:0.09-19.1.1.ep5.el5
0:0.09-19.1.1.ep5.el5
redhat/msv<0:1.2-0.20050722.6.jdk6.ep5.el5
0:1.2-0.20050722.6.jdk6.ep5.el5
redhat/mx4j<1:3.0.1-9.3.1.jdk6.ep5.el5
1:3.0.1-9.3.1.jdk6.ep5.el5
redhat/objectweb-asm<0:3.1-5.3.1.jdk6.ep5.el5
0:3.1-5.3.1.jdk6.ep5.el5
redhat/org-mc4j-ems<0:1.2.15.1-2.jdk6.ep5.el5
0:1.2.15.1-2.jdk6.ep5.el5
redhat/quartz<0:1.5.2-6.3.patch01.jdk6.ep5.el5
0:1.5.2-6.3.patch01.jdk6.ep5.el5
redhat/regexp<0:1.5-1.2.1.jdk6.ep5.el5
0:1.5-1.2.1.jdk6.ep5.el5
redhat/resteasy<0:1.2.1-7.jdk6.ep5.el5
0:1.2.1-7.jdk6.ep5.el5
redhat/rh-ewp-docs<0:5.1.0-5.jdk6.ep5.el5
0:5.1.0-5.jdk6.ep5.el5
redhat/rhq<0:3.0.0-9.EmbJopr2.1.jdk6.ep5.el5
0:3.0.0-9.EmbJopr2.1.jdk6.ep5.el5
redhat/rhq-jmx-plugin<0:3.0.0-12.EmbJopr2.jdk6.ep5.el5
0:3.0.0-12.EmbJopr2.jdk6.ep5.el5
redhat/rhq-platform-plugin<0:3.0.0-9.EmbJopr2.jdk6.ep5.el5
0:3.0.0-9.EmbJopr2.jdk6.ep5.el5
redhat/richfaces<0:3.3.1-0.25.jdk6.ep5.el5
0:3.3.1-0.25.jdk6.ep5.el5
redhat/scannotation<0:1.0.2-3.1.jdk6.ep5.el5
0:1.0.2-3.1.jdk6.ep5.el5
redhat/servletapi4<0:4.0.4-6.2.1.1.jdk6.ep5.el5
0:4.0.4-6.2.1.1.jdk6.ep5.el5
redhat/slf4j<0:1.5.8-1.2.1.jdk6.ep5.el5
0:1.5.8-1.2.1.jdk6.ep5.el5
redhat/slf4j-jboss-logging<0:1.0.2-1.3.1.jdk6.ep5.el5
0:1.0.2-1.3.1.jdk6.ep5.el5
redhat/snmptrapappender<0:1.2.8-7.1.jdk6.ep5.el5
0:1.2.8-7.1.jdk6.ep5.el5
redhat/spring2<0:2.5.6-8.SEC02.2.jdk6.ep5.el5
0:2.5.6-8.SEC02.2.jdk6.ep5.el5
redhat/stax-ex<0:1.2-8.jdk6.ep5.el5
0:1.2-8.jdk6.ep5.el5
redhat/sun-fi<0:1.2.7-4.1.jdk6.ep5.el5
0:1.2.7-4.1.jdk6.ep5.el5
redhat/sun-sjsxp<0:1.0.1-4.1.jdk6.ep5.el5
0:1.0.1-4.1.jdk6.ep5.el5
redhat/sun-ws-metadata<2.0-api-0:1.0.MR1-7.jdk6.ep5.el5
2.0-api-0:1.0.MR1-7.jdk6.ep5.el5
redhat/sun-xmlstreambuffer<0:0.8-0.2.1.jdk6.ep5.el5
0:0.8-0.2.1.jdk6.ep5.el5
redhat/sun-xsom<0:20070515-2.2.1.jdk6.ep5.el5
0:20070515-2.2.1.jdk6.ep5.el5
redhat/tomcat-native<0:1.1.19-4.0.1.jdk6.ep5.el5
0:1.1.19-4.0.1.jdk6.ep5.el5
redhat/velocity<0:1.6.3-0.1.1.1.jdk6.ep5.el5
0:1.6.3-0.1.1.1.jdk6.ep5.el5
redhat/werken-xpath<0:0.9.4-0.beta.13.3.1.jdk6.ep5.el5
0:0.9.4-0.beta.13.3.1.jdk6.ep5.el5
redhat/ws-commons-axiom<0:1.2.7-2.3.jdk6.ep5.el5
0:1.2.7-2.3.jdk6.ep5.el5
redhat/ws-commons-neethi<0:2.0.4-1.2.2.1.jdk6.ep5.el5
0:2.0.4-1.2.2.1.jdk6.ep5.el5
redhat/wsdl4j16<0:1.6.2-7.4.jdk6.ep5.el5
0:1.6.2-7.4.jdk6.ep5.el5
redhat/ws-fx-addressing<0:1.0-3.2.1.jdk6.ep5.el5
0:1.0-3.2.1.jdk6.ep5.el5
redhat/ws-jaxme<0:0.5.1-11.1.jdk6.ep5.el5
0:0.5.1-11.1.jdk6.ep5.el5
redhat/wss4j<0:1.5.8-5.jdk6.ep5.el5
0:1.5.8-5.jdk6.ep5.el5
redhat/ws-scout<0:1.1.1-3.4.1.jdk6.ep5.el5
0:1.1.1-3.4.1.jdk6.ep5.el5
redhat/wstx<0:3.2.9-1.2.jdk6.ep5.el5
0:3.2.9-1.2.jdk6.ep5.el5
redhat/xalan-j2<0:2.7.1-3.2.jdk6.ep5.el5
0:2.7.1-3.2.jdk6.ep5.el5
redhat/xdoclet<0:1.2.3-14.1.jdk6.ep5.el5
0:1.2.3-14.1.jdk6.ep5.el5
redhat/xerces-j2<0:2.9.1-2.3.1.jdk6.ep5.el5
0:2.9.1-2.3.1.jdk6.ep5.el5
redhat/xjavadoc<0:1.1-1.3.1.jdk6.ep5.el5
0:1.1-1.3.1.jdk6.ep5.el5
redhat/xml-commons<0:1.3.04-7.10.jdk6.ep5.el5
0:1.3.04-7.10.jdk6.ep5.el5
redhat/xml-im-exporter<0:1.1-3.1.jdk6.ep5.el5
0:1.1-3.1.jdk6.ep5.el5
redhat/xml-security<0:1.4.3-4.1.jdk6.ep5.el5
0:1.4.3-4.1.jdk6.ep5.el5
redhat/xom<0:1.0-4.1.jdk6.ep5.el5
0:1.0-4.1.jdk6.ep5.el5
redhat/xpp2<0:2.1.10-6.1.jdk6.ep5.el5
0:2.1.10-6.1.jdk6.ep5.el5
redhat/xpp3<0:1.1.4-0.4.1.jdk6.ep5.el5
0:1.1.4-0.4.1.jdk6.ep5.el5
redhat/xstream<0:1.3.1-1.4.1.jdk6.ep5.el5
0:1.3.1-1.4.1.jdk6.ep5.el5
redhat/jboss-aop<0:1.5.5-1.CP01.0jpp.ep1.1.el4
0:1.5.5-1.CP01.0jpp.ep1.1.el4
redhat/jbossas<0:4.3.0-2.GA_CP01.ep1.7.el4
0:4.3.0-2.GA_CP01.ep1.7.el4
redhat/jboss-messaging<0:1.4.0-1.SP3_CP02.0jpp.ep1.6.el4
0:1.4.0-1.SP3_CP02.0jpp.ep1.6.el4
redhat/jboss-seam<0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.7.el4
0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.7.el4
redhat/jbossws<0:2.0.1-2.SP2_CP01.0jpp.ep1.2.el4
0:2.0.1-2.SP2_CP01.0jpp.ep1.2.el4
redhat/jgroups<1:2.4.2-1.GA_CP01.0jpp.ep1.1.el4
1:2.4.2-1.GA_CP01.0jpp.ep1.1.el4
redhat/rh-eap-docs<0:4.3.0-2.GA_CP01.ep1.4.el4
0:4.3.0-2.GA_CP01.ep1.4.el4
redhat/asm<0:1.5.3-1jpp.ep1.2.el5
0:1.5.3-1jpp.ep1.2.el5
redhat/cglib<0:2.1.3-2jpp.ep1.6.el5
0:2.1.3-2jpp.ep1.6.el5
redhat/concurrent<0:1.3.4-8jpp.ep1.6.el5.1
0:1.3.4-8jpp.ep1.6.el5.1
redhat/glassfish-jsf<0:1.2_08-0jpp.ep1.2.el5
0:1.2_08-0jpp.ep1.2.el5
redhat/hibernate3-entitymanager<0:3.2.1-1jpp.ep1.7.el5
0:3.2.1-1jpp.ep1.7.el5
redhat/jboss-aop<0:1.5.5-1.CP01.0jpp.ep1.1.el5
0:1.5.5-1.CP01.0jpp.ep1.1.el5
redhat/jbossas<0:4.3.0-2.GA_CP01.ep1.6.el5.1
0:4.3.0-2.GA_CP01.ep1.6.el5.1
redhat/jboss-messaging<0:1.4.0-1.SP3_CP02.0jpp.ep1.6.el5
0:1.4.0-1.SP3_CP02.0jpp.ep1.6.el5
redhat/jboss-seam<0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.5.el5.1
0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.5.el5.1
redhat/jbossws<0:2.0.1-2.SP2_CP01.0jpp.ep1.2.el5
0:2.0.1-2.SP2_CP01.0jpp.ep1.2.el5
redhat/jbossxb<0:1.0.0-2.SP1.0jpp.ep1.2.el5.1
0:1.0.0-2.SP1.0jpp.ep1.2.el5.1
redhat/jgroups<1:2.4.2-1.GA_CP01.0jpp.ep1.1.el5
1:2.4.2-1.GA_CP01.0jpp.ep1.1.el5
redhat/rh-eap-docs<0:4.3.0-2.GA_CP01.ep1.4.el5
0:4.3.0-2.GA_CP01.ep1.4.el5
JBOSS Enterprise Application Platform<=4.2.0.cp03
JBOSS Enterprise Application Platform<=4.3.0
JBOSS Enterprise Application Platform=4.2.0.cp01
JBOSS Enterprise Application Platform=4.2.0.cp02
Event History
Aug 4, 2008
Data Sourced
01:53 PM
DescriptionSeverityAffected Software
Aug 5, 2008
CVE Published
12:00 AM
Aug 10, 2008
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
1
What is the severity of CVE-2008-3273?
CVE-2008-3273 has been classified as a moderate severity vulnerability due to the exposure of sensitive information.
2
How do I fix CVE-2008-3273?
To address CVE-2008-3273, update to JBoss Enterprise Application Platform versions 4.2.0.CP03 or 4.3.0.CP01 and later.
3
What types of software are affected by CVE-2008-3273?
CVE-2008-3273 affects multiple JBoss products, including JBoss Enterprise Application Platform versions below 4.2.0.CP03 and 4.3.0 prior to 4.3.0.CP01.
4
What does CVE-2008-3273 expose to attackers?
CVE-2008-3273 allows remote attackers to gain access to sensitive information regarding deployed web contexts through a request to the status servlet.
5
What recommendations do you have for securing systems affected by CVE-2008-3273?
It is recommended to promptly patch affected systems and restrict access to the status servlet to mitigate the risk associated with CVE-2008-3273.