CVE-2008-3519: Medium severity jboss enterprise application platform vulnerability
The default configuration of the JBossAs component in Red Hat JBoss Enterprise Application Platform (aka JBossEAP or EAP), possibly 4.2 before CP04 and 4.3 before CP02, when a production environment is enabled, sets the DownloadServerClasses property to true, which allows remote attackers to obtain sensitive information (non-EJB classes) via a download request, a different vulnerability than CVE-2008-3273.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2008-3519?
CVE-2008-3519 is considered a critical vulnerability due to potential unauthorized access to sensitive server classes.
How do I fix CVE-2008-3519?
To fix CVE-2008-3519, disable the DownloadServerClasses property in the JBoss configuration.
Which versions are affected by CVE-2008-3519?
CVE-2008-3519 affects JBoss Enterprise Application Platform versions 4.2 before CP04 and 4.3 before CP02.
Can CVE-2008-3519 allow remote code execution?
Yes, CVE-2008-3519 can potentially allow remote attackers to execute code on the server.
Is there a workaround for CVE-2008-3519?
A possible workaround for CVE-2008-3519 is to restrict access to the JBoss server or change firewall settings.