CVE-2010-3878: CSRF

Published Jun 16, 2010

Updated

Cross-site request forgery (CSRF) vulnerability in the JMX Console in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 allows remote attackers to hijack the authentication of administrators for requests that deploy WAR files.

Affected Software

9 affected components

redhat JBoss Enterprise Application Platform=4.3.0-cp06

redhat JBoss Enterprise Application Platform=4.3.0

redhat JBoss Enterprise Application Platform=4.3.0-cp01

redhat JBoss Enterprise Application Platform=4.3.0-cp04

redhat JBoss Enterprise Application Platform=4.3.0-cp07

redhat JBoss Enterprise Application Platform=4.3.0-cp03

redhat JBoss Enterprise Application Platform=4.3.0-cp02

redhat JBoss Enterprise Application Platform=4.3.0-cp08

redhat JBoss Enterprise Application Platform=4.3.0-cp05

Event History

Jun 16, 2010

Data Sourced

10:54 AM

DescriptionSeverityAffected Software

Dec 30, 2010

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2010-3878?

CVE-2010-3878 is classified as a high severity vulnerability due to its potential to allow unauthorized administrator access.

How do I mitigate CVE-2010-3878?

To mitigate CVE-2010-3878, it's recommended to upgrade to Red Hat JBoss Enterprise Application Platform 4.3.0.CP09 or later.

What type of vulnerability is CVE-2010-3878?

CVE-2010-3878 is a cross-site request forgery (CSRF) vulnerability.

Which versions of JBoss EAP are affected by CVE-2010-3878?

CVE-2010-3878 affects various versions of Red Hat JBoss Enterprise Application Platform 4.3.0, including CP01 to CP08.

Can CVE-2010-3878 lead to remote attacks?

Yes, CVE-2010-3878 allows remote attackers to hijack administrator authentication, potentially leading to unauthorized actions.