CVE-2010-1429: Medium severity redhat JBoss Enterprise Application Platform vulnerability
Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 allows remote attackers to obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string. NOTE: this issue exists because of a CVE-2008-3273 regression.
Other sources
The JBoss Enterprise Application Platform 4.2.0.CP03 and 4.3.0.CP01 updates for Red Hat Enterprise Linux 4 and 5 fixed an issue (CVE-2008-3273) where unauthenticated users were able to access the status servlet; however, a bug fix included in the 4.2.0.CP06 and 4.3.0.CP04 updates re-introduced the issue.
A remote attacker could use this flaw to acquire details about deployed web contexts.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-1429?
CVE-2010-1429 has a medium severity rating.
How do I fix CVE-2010-1429?
To fix CVE-2010-1429, update Red Hat JBoss Enterprise Application Platform to at least version 4.2.0.CP09 or 4.3.0.CP08.
What versions are affected by CVE-2010-1429?
CVE-2010-1429 affects Red Hat JBoss Enterprise Application Platform versions 4.2.0 and 4.3.0 prior to specified patch releases.
What type of attack does CVE-2010-1429 allow?
CVE-2010-1429 allows remote attackers to obtain sensitive information about deployed web contexts via crafted requests.
Is CVE-2010-1429 related to unauthorized access?
While CVE-2010-1429 does not allow unauthorized access directly, it exposes sensitive information that could facilitate further attacks.