CVE-2010-1428: Red Hat JBoss Information Disclosure Vulnerability
The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an unspecified request that uses a different method.
Other sources
Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP "verbs". A remote attacker could use this flaw to gain access to sensitive information.
— Red Hat
Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information.
— CISA
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-1428?
CVE-2010-1428 is classified as a high severity vulnerability due to its potential to expose sensitive information.
How do I fix CVE-2010-1428?
To fix CVE-2010-1428, update to JBoss Enterprise Application Platform version 4.2.0.CP09 or 4.3.0.CP08 or later.
What types of access does CVE-2010-1428 affect?
CVE-2010-1428 affects access control for the GET and POST methods, allowing unauthorized access.
Is CVE-2010-1428 present in JBoss EAP 4.3.0?
Yes, CVE-2010-1428 is present in JBoss EAP versions 4.2.0 before CP09 and 4.3.0 before CP08.
What impact does CVE-2010-1428 have on applications using JBoss?
CVE-2010-1428 can lead to unauthorized access to sensitive information within applications that use vulnerable JBoss versions.