CVE-2010-2493: Medium severity red hat jboss enterprise soa platform vulnerability
The default configuration of the deployment descriptor (aka web.xml) in picketlink-sts.war in (1) the securitysaml quickstart, (2) the webserviceproxysecurity quickstart, (3) the web-console application, (4) the http-invoker application, (5) the gpd-deployer application, (6) the jbpm-console application, (7) the contract application, and (8) the uddi-console application in JBoss Enterprise SOA Platform before 5.0.2 contains GET and POST http-method elements, which allows remote attackers to bypass intended access restrictions via a crafted HTTP request.
Other sources
The deployment descriptor (web.xml) of picketlink-sts.war in the securitysaml quickstart, the webserviceproxysecurity quickstart, and some of the included web applications (web-console, http-invoker, gpd-deployer, jbpm-console, contract, and uddi-console), contained a configuration that could allow an attacker to bypass the application's security with a crafted HTTP request. To resolve these issues, the following lines have been removed from the web.xml files of the affected quickstarts and applications:
<http-method>GET</http-method> <http-method>POST</http-method>
If the securitysaml quickstart was used to create another application, then that new application will need to be reviewed to ensure it does not have this issue.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2493?
CVE-2010-2493 is classified as a moderate severity vulnerability.
How do I fix CVE-2010-2493?
To fix CVE-2010-2493, review and update the web.xml configuration in the affected applications to align with secure deployment practices.
Which versions are affected by CVE-2010-2493?
CVE-2010-2493 affects specific versions of Red Hat JBoss Enterprise SOA Platform, including versions from 4.2.0 to 5.0.0.
What applications are impacted by CVE-2010-2493?
The applications affected by CVE-2010-2493 include security_saml quickstart, webservice_proxy_security quickstart, web-console, and others in the deployment descriptor.
Is there a patch available for CVE-2010-2493?
Yes, Red Hat has provided patches in updates for the affected versions, which should be applied to mitigate the vulnerability.