CVE-2010-0738: Red Hat JBoss Authentication Bypass Vulnerability

Published Mar 16, 2010
·
Updated

By using a specially crafted HTTP request, the authentication of the jmx-console can be bypassed, as the access restrictions only apply for GET and POST.

Current setting is:

<security-constraint> <web-resource-collection> <web-resource-name>HtmlAdaptor</web-resource-name> <description>An example security config that only allows users with the role JBossAdmin to access the HTML JMX console web application </description> <url-pattern>/</url-pattern> <http-method>GET</http-method> <http-method>POST</http-method> </web-resource-collection> <auth-constraint> <role-name>JBossAdmin</role-name> </auth-constraint> </security-constraint>

and should be changed to block ALL http-methods.

Acknowledgements:

Red Hat would like to thank Stefano Di Paola and Giorgio Fedon of Minded Security for responsibly reporting this issue.

Other sources

The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.

The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.

— CISA

Affected Software

56 affected componentsFixes available
redhat/hibernate3<1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el4
1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el4
redhat/hibernate3-annotations<0:3.3.1-1.12.GA_CP03.ep1.el4
0:3.3.1-1.12.GA_CP03.ep1.el4
redhat/hsqldb<1:1.8.0.8-3.patch03.1jpp.ep1.3.el4
1:1.8.0.8-3.patch03.1jpp.ep1.3.el4
redhat/jacorb<0:2.3.0-1jpp.ep1.10.el4
0:2.3.0-1jpp.ep1.10.el4
redhat/jakarta-commons-httpclient<1:3.0.1-1.patch01.1jpp.ep1.4.el4
1:3.0.1-1.patch01.1jpp.ep1.4.el4
redhat/jboss-aop<0:1.5.5-3.CP05.2.ep1.el4
0:1.5.5-3.CP05.2.ep1.el4
redhat/jbossas<0:4.2.0-6.GA_CP09.6.ep1.el4
0:4.2.0-6.GA_CP09.6.ep1.el4
redhat/jboss-cache<0:1.4.1-6.SP14.1.ep1.el4
0:1.4.1-6.SP14.1.ep1.el4
redhat/jboss-remoting<0:2.2.3-3.SP2.ep1.el4
0:2.2.3-3.SP2.ep1.el4
redhat/jboss-seam<0:1.2.1-1.ep1.24.el4
0:1.2.1-1.ep1.24.el4
redhat/jbossts<1:4.2.3-1.SP5_CP09.1jpp.ep1.1.el4
1:4.2.3-1.SP5_CP09.1jpp.ep1.1.el4
redhat/jbossweb<0:2.0.0-6.CP13.0jpp.ep1.1.el4
0:2.0.0-6.CP13.0jpp.ep1.1.el4
redhat/rh-eap-docs<0:4.2.0-7.GA_CP09.ep1.5.el4
0:4.2.0-7.GA_CP09.ep1.5.el4
redhat/hibernate3<1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el5
1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el5
redhat/hibernate3-annotations<0:3.3.1-1.12.GA_CP03.ep1.el5
0:3.3.1-1.12.GA_CP03.ep1.el5
redhat/jacorb<0:2.3.0-1jpp.ep1.10.1.el5
0:2.3.0-1jpp.ep1.10.1.el5
redhat/jboss-aop<0:1.5.5-3.CP05.2.ep1.1.el5
0:1.5.5-3.CP05.2.ep1.1.el5
redhat/jbossas<0:4.2.0-6.GA_CP09.6.ep1.el5
0:4.2.0-6.GA_CP09.6.ep1.el5
redhat/jboss-cache<0:1.4.1-6.SP14.1.ep1.1.el5
0:1.4.1-6.SP14.1.ep1.1.el5
redhat/jboss-remoting<0:2.2.3-3.SP2.ep1.1.el5
0:2.2.3-3.SP2.ep1.1.el5
redhat/jboss-seam<0:1.2.1-1.ep1.24.el5
0:1.2.1-1.ep1.24.el5
redhat/jbossts<1:4.2.3-1.SP5_CP09.1jpp.ep1.1.1.el5
1:4.2.3-1.SP5_CP09.1jpp.ep1.1.1.el5
redhat/jbossweb<0:2.0.0-6.CP13.0jpp.ep1.1.1.el5
0:2.0.0-6.CP13.0jpp.ep1.1.1.el5
redhat/rh-eap-docs<0:4.2.0-7.GA_CP09.ep1.4.1.el5
0:4.2.0-7.GA_CP09.ep1.4.1.el5
redhat/jbossas<0:4.3.0-7.GA_CP08.5.ep1.el4
0:4.3.0-7.GA_CP08.5.ep1.el4
redhat/jboss-messaging<0:1.4.0-3.SP3_CP10.2.ep1.el4
0:1.4.0-3.SP3_CP10.2.ep1.el4
redhat/jboss-seam<0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el4
0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el4
redhat/jboss-seam2<0:2.0.2.FP-1.ep1.23.el4
0:2.0.2.FP-1.ep1.23.el4
redhat/jbossws<0:2.0.1-5.SP2_CP08.1.ep1.el4
0:2.0.1-5.SP2_CP08.1.ep1.el4
redhat/rh-eap-docs<0:4.3.0-7.GA_CP08.ep1.6.el4
0:4.3.0-7.GA_CP08.ep1.6.el4
redhat/jbossas<0:4.3.0-7.GA_CP08.5.ep1.el5
0:4.3.0-7.GA_CP08.5.ep1.el5
redhat/jboss-messaging<0:1.4.0-3.SP3_CP10.2.ep1.el5
0:1.4.0-3.SP3_CP10.2.ep1.el5
redhat/jboss-seam<0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el5.1
0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el5.1
redhat/jboss-seam2<0:2.0.2.FP-1.ep1.23.el5
0:2.0.2.FP-1.ep1.23.el5
redhat/jbossws<0:2.0.1-5.SP2_CP08.1.ep1.1.el5
0:2.0.1-5.SP2_CP08.1.ep1.1.el5
redhat/rh-eap-docs<0:4.3.0-7.GA_CP08.ep1.5.el5
0:4.3.0-7.GA_CP08.ep1.5.el5
redhat JBoss Enterprise Application Platform=4.2.0-cp01
redhat JBoss Enterprise Application Platform=4.2.0-cp06
redhat JBoss Enterprise Application Platform=4.2
redhat JBoss Enterprise Application Platform=4.2.0-cp05
redhat JBoss Enterprise Application Platform=4.2.0-cp04
redhat JBoss Enterprise Application Platform=4.2.0-cp03
redhat JBoss Enterprise Application Platform=4.2.0-cp07
redhat JBoss Enterprise Application Platform=4.2.0-cp08
redhat JBoss Enterprise Application Platform=4.2.0-cp02
redhat JBoss Enterprise Application Platform=4.3.0-cp06
redhat JBoss Enterprise Application Platform=4.3.0-cp01
redhat JBoss Enterprise Application Platform=4.3.0-cp04
redhat JBoss Enterprise Application Platform=4.3
redhat JBoss Enterprise Application Platform=4.3.0-cp07
redhat JBoss Enterprise Application Platform=4.3.0-cp03
redhat JBoss Enterprise Application Platform=4.3.0-cp02
redhat JBoss Enterprise Application Platform=4.3.0-cp05
Red Hat JBoss
redhat JBoss Enterprise Application Platform=4.2.0
redhat JBoss Enterprise Application Platform=4.3.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/hibernate3 to a version that resolves this vulnerability.

    Fixed in 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el4
  2. Upgrade

    Upgrade redhat/hibernate3-annotations to a version that resolves this vulnerability.

    Fixed in 0:3.3.1-1.12.GA_CP03.ep1.el4
  3. Upgrade

    Upgrade redhat/hsqldb to a version that resolves this vulnerability.

    Fixed in 1:1.8.0.8-3.patch03.1jpp.ep1.3.el4
  4. Upgrade

    Upgrade redhat/jacorb to a version that resolves this vulnerability.

    Fixed in 0:2.3.0-1jpp.ep1.10.el4
  5. Upgrade

    Upgrade redhat/jakarta-commons-httpclient to a version that resolves this vulnerability.

    Fixed in 1:3.0.1-1.patch01.1jpp.ep1.4.el4
  6. Upgrade

    Upgrade redhat/jboss-aop to a version that resolves this vulnerability.

    Fixed in 0:1.5.5-3.CP05.2.ep1.el4
  7. Upgrade

    Upgrade redhat/jbossas to a version that resolves this vulnerability.

    Fixed in 0:4.2.0-6.GA_CP09.6.ep1.el4
  8. Upgrade

    Upgrade redhat/jboss-cache to a version that resolves this vulnerability.

    Fixed in 0:1.4.1-6.SP14.1.ep1.el4
  9. Upgrade

    Upgrade redhat/jboss-remoting to a version that resolves this vulnerability.

    Fixed in 0:2.2.3-3.SP2.ep1.el4
  10. Upgrade

    Upgrade redhat/jboss-seam to a version that resolves this vulnerability.

    Fixed in 0:1.2.1-1.ep1.24.el4
  11. Upgrade

    Upgrade redhat/jbossts to a version that resolves this vulnerability.

    Fixed in 1:4.2.3-1.SP5_CP09.1jpp.ep1.1.el4
  12. Upgrade

    Upgrade redhat/jbossweb to a version that resolves this vulnerability.

    Fixed in 0:2.0.0-6.CP13.0jpp.ep1.1.el4
  13. Upgrade

    Upgrade redhat/rh-eap-docs to a version that resolves this vulnerability.

    Fixed in 0:4.2.0-7.GA_CP09.ep1.5.el4
  14. Upgrade

    Upgrade redhat/hibernate3 to a version that resolves this vulnerability.

    Fixed in 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el5
  15. Upgrade

    Upgrade redhat/hibernate3-annotations to a version that resolves this vulnerability.

    Fixed in 0:3.3.1-1.12.GA_CP03.ep1.el5
  16. Upgrade

    Upgrade redhat/jacorb to a version that resolves this vulnerability.

    Fixed in 0:2.3.0-1jpp.ep1.10.1.el5
  17. Upgrade

    Upgrade redhat/jboss-aop to a version that resolves this vulnerability.

    Fixed in 0:1.5.5-3.CP05.2.ep1.1.el5
  18. Upgrade

    Upgrade redhat/jbossas to a version that resolves this vulnerability.

    Fixed in 0:4.2.0-6.GA_CP09.6.ep1.el5
  19. Upgrade

    Upgrade redhat/jboss-cache to a version that resolves this vulnerability.

    Fixed in 0:1.4.1-6.SP14.1.ep1.1.el5
  20. Upgrade

    Upgrade redhat/jboss-remoting to a version that resolves this vulnerability.

    Fixed in 0:2.2.3-3.SP2.ep1.1.el5
  21. Upgrade

    Upgrade redhat/jboss-seam to a version that resolves this vulnerability.

    Fixed in 0:1.2.1-1.ep1.24.el5
  22. Upgrade

    Upgrade redhat/jbossts to a version that resolves this vulnerability.

    Fixed in 1:4.2.3-1.SP5_CP09.1jpp.ep1.1.1.el5
  23. Upgrade

    Upgrade redhat/jbossweb to a version that resolves this vulnerability.

    Fixed in 0:2.0.0-6.CP13.0jpp.ep1.1.1.el5
  24. Upgrade

    Upgrade redhat/rh-eap-docs to a version that resolves this vulnerability.

    Fixed in 0:4.2.0-7.GA_CP09.ep1.4.1.el5
  25. Upgrade

    Upgrade redhat/jbossas to a version that resolves this vulnerability.

    Fixed in 0:4.3.0-7.GA_CP08.5.ep1.el4
  26. Upgrade

    Upgrade redhat/jboss-messaging to a version that resolves this vulnerability.

    Fixed in 0:1.4.0-3.SP3_CP10.2.ep1.el4
  27. Upgrade

    Upgrade redhat/jboss-seam to a version that resolves this vulnerability.

    Fixed in 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el4
  28. Upgrade

    Upgrade redhat/jboss-seam2 to a version that resolves this vulnerability.

    Fixed in 0:2.0.2.FP-1.ep1.23.el4
  29. Upgrade

    Upgrade redhat/jbossws to a version that resolves this vulnerability.

    Fixed in 0:2.0.1-5.SP2_CP08.1.ep1.el4
  30. Upgrade

    Upgrade redhat/rh-eap-docs to a version that resolves this vulnerability.

    Fixed in 0:4.3.0-7.GA_CP08.ep1.6.el4
  31. Upgrade

    Upgrade redhat/jbossas to a version that resolves this vulnerability.

    Fixed in 0:4.3.0-7.GA_CP08.5.ep1.el5
  32. Upgrade

    Upgrade redhat/jboss-messaging to a version that resolves this vulnerability.

    Fixed in 0:1.4.0-3.SP3_CP10.2.ep1.el5
  33. Upgrade

    Upgrade redhat/jboss-seam to a version that resolves this vulnerability.

    Fixed in 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el5.1
  34. Upgrade

    Upgrade redhat/jboss-seam2 to a version that resolves this vulnerability.

    Fixed in 0:2.0.2.FP-1.ep1.23.el5
  35. Upgrade

    Upgrade redhat/jbossws to a version that resolves this vulnerability.

    Fixed in 0:2.0.1-5.SP2_CP08.1.ep1.1.el5
  36. Upgrade

    Upgrade redhat/rh-eap-docs to a version that resolves this vulnerability.

    Fixed in 0:4.3.0-7.GA_CP08.ep1.5.el5
  37. Configuration

    Update the JMX-Console security configuration so that access control for the HTML JMX console is applied to ALL HTTP methods, not only GET and POST. Ensure the auth-constraint for role 'JBossAdmin' does not limit enforcement to just GET/POST for url-pattern '/*'.

    JMX-Console web application (Red Hat JBoss Enterprise Application Platform / JBoss EAP) security-constraint auth-constraint for allowed http-methods (web.xml or equivalent) = block ALL http-methods (remove specific GET/POST-only restrictions)

Event History

Mar 16, 2010
Data Sourced
via Red Hat·04:20 PM
DescriptionSeverityAffected Software
Apr 26, 2010
CVE Published
12:00 AM
Apr 28, 2010
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Data Sourced
via NVD·10:30 PM
DescriptionSeverityWeaknessAffected Software
May 25, 2022
Known Exploited
via CISA·12:00 AM
Known Ransomware
via CISA·12:00 AM

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is the severity of CVE-2010-0738?

CVE-2010-0738 is considered a high severity vulnerability.

2

How do I fix CVE-2010-0738?

To fix CVE-2010-0738, you should upgrade to the appropriate patched version of the affected packages from Red Hat.

3

What types of requests does CVE-2010-0738 allow attackers to perform?

CVE-2010-0738 allows attackers to bypass access control and send requests using methods other than GET and POST.

4

Which software versions are affected by CVE-2010-0738?

CVE-2010-0738 affects specific versions of Red Hat JBoss Enterprise Application Platform including 4.2.0 and 4.3.0.

5

What is the potential impact of CVE-2010-0738?

The potential impact of CVE-2010-0738 includes unauthorized access and manipulation of server resources.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203