CVE-2010-1428: Red Hat JBoss Information Disclosure Vulnerability
First published: Mon Apr 26 2010(Updated: )
The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an unspecified request that uses a different method.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| JBoss Enterprise Application Platform | =4.2.0 | |
| JBoss Enterprise Application Platform | =4.3.0 | |
| JBoss Enterprise Application Platform | =4.3.0-cp06 | |
| JBoss Enterprise Application Platform | =4.2.0-cp01 | |
| JBoss Enterprise Application Platform | =4.2.0-cp06 | |
| JBoss Enterprise Application Platform | <=4.3.0 | |
| JBoss Enterprise Application Platform | =4.2 | |
| JBoss Enterprise Application Platform | =4.3.0-cp01 | |
| JBoss Enterprise Application Platform | =4.2.0-cp05 | |
| JBoss Enterprise Application Platform | =4.2.0-cp04 | |
| JBoss Enterprise Application Platform | =4.3.0-cp04 | |
| JBoss Enterprise Application Platform | =4.2.0-cp03 | |
| JBoss Enterprise Application Platform | =4.3 | |
| JBoss Enterprise Application Platform | =4.2.0-cp07 | |
| JBoss Enterprise Application Platform | =4.3.0-cp03 | |
| JBoss Enterprise Application Platform | =4.3.0-cp02 | |
| JBoss Enterprise Application Platform | <=4.2.0 | |
| JBoss Enterprise Application Platform | =4.3.0-cp05 | |
| JBoss Enterprise Application Platform | =4.2.0-cp02 | |
| JBoss |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/39710
- https://bugzilla.redhat.com/show_bug.cgi?id=585899
- https://rhn.redhat.com/errata/RHSA-2010-0376.html
- http://secunia.com/advisories/39563
- http://www.vupen.com/english/advisories/2010/0992
- https://rhn.redhat.com/errata/RHSA-2010-0378.html
- https://rhn.redhat.com/errata/RHSA-2010-0379.html
- https://rhn.redhat.com/errata/RHSA-2010-0377.html
- http://securitytracker.com/id?1023917
- http://marc.info/?l=bugtraq&m=132698550418872&w=2
- https://exchange.xforce.ibmcloud.com/vulnerabilities/58148
- https://nvd.nist.gov/vuln/detail/CVE-2010-1428
Frequently Asked Questions
What is the severity of CVE-2010-1428?
CVE-2010-1428 is classified as a high severity vulnerability due to its potential to expose sensitive information.
How do I fix CVE-2010-1428?
To fix CVE-2010-1428, update to JBoss Enterprise Application Platform version 4.2.0.CP09 or 4.3.0.CP08 or later.
What types of access does CVE-2010-1428 affect?
CVE-2010-1428 affects access control for the GET and POST methods, allowing unauthorized access.
Is CVE-2010-1428 present in JBoss EAP 4.3.0?
Yes, CVE-2010-1428 is present in JBoss EAP versions 4.2.0 before CP09 and 4.3.0 before CP08.
What impact does CVE-2010-1428 have on applications using JBoss?
CVE-2010-1428 can lead to unauthorized access to sensitive information within applications that use vulnerable JBoss versions.
- agent/type
- agent/title
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2010-1428
- agent/author
- agent/severity
- agent/description
- agent/references
- agent/source
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/event
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-api
- collector/nvd-historical
- collector/nvd-index
- agent/softwarecombine
- agent/tags
- exploited/true
- ransomware/true
- collector/cisa-known-exploited
- source/CISA
- vendor/redhat
- canonical/jboss enterprise application platform
- version/jboss enterprise application platform/4.2.0
- version/jboss enterprise application platform/4.3.0
- version/jboss enterprise application platform/4.3.0-cp06
- version/jboss enterprise application platform/4.2.0-cp01
- version/jboss enterprise application platform/4.2.0-cp06
- version/jboss enterprise application platform/4.2
- version/jboss enterprise application platform/4.3.0-cp01
- version/jboss enterprise application platform/4.2.0-cp05
- version/jboss enterprise application platform/4.2.0-cp04
- version/jboss enterprise application platform/4.3.0-cp04
- version/jboss enterprise application platform/4.2.0-cp03
- version/jboss enterprise application platform/4.3
- version/jboss enterprise application platform/4.2.0-cp07
- version/jboss enterprise application platform/4.3.0-cp03
- version/jboss enterprise application platform/4.3.0-cp02
- version/jboss enterprise application platform/4.3.0-cp05
- version/jboss enterprise application platform/4.2.0-cp02
- vendor/red hat
- canonical/jboss