Medium severity · published Apr 28, 2010
CVE-2010-0738
Red Hat JBoss Authentication Bypass Vulnerability
RansomwareIn wildKEV
5.3
CVSS
73.8%
EPSS
Yes
On KEV
Description
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)73.8% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed May 25, 2022
Federal remediation dueJun 15, 2022
Ransomware campaign useKnown
Affected products
Which versions
JE
Jboss Enterprise Application Platform · Redhat
4.2.0; 4.3.0 · source: NVD
JB
JBoss · Red Hat
All versions, or not specified · source: KEV
Affected product
JE
Jboss Enterprise Application Platform
Redhat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-0738
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-0738
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
vendor-advisory
https://rhn.redhat.com/errata/RHSA-2010-0379.html
vendor-advisory
https://rhn.redhat.com/errata/RHSA-2010-0378.html
x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=574105
vendor-advisory
https://rhn.redhat.com/errata/RHSA-2010-0376.html
third-party-advisory
http://securityreason.com/securityalert/8408
vendor-advisory
https://rhn.redhat.com/errata/RHSA-2010-0377.html
More from Jboss Enterprise Application Platform
9.8
CVE-2017-12149
Red Hat JBoss Application Server Remote Code Execution Vulnerability
8.8
CVE-2010-1871
Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability
8.1
CVE-2017-12617
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g
7.5
CVE-2010-1428
Red Hat JBoss Information Disclosure Vulnerability
10.0
CVE-2018-14721
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class…