Vulnerability Description
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Jboss Enterprise Application Platform | 4.2.0 |
Related Weaknesses (CWE)
References
- http://marc.info/?l=bugtraq&m=132129312609324&w=2ExploitMailing List
- http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspxThird Party Advisory
- http://secunia.com/advisories/39563Broken LinkVendor Advisory
- http://securityreason.com/securityalert/8408Broken Link
- http://securitytracker.com/id?1023918Broken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/39710Broken LinkThird Party AdvisoryVDB Entry
- http://www.vupen.com/english/advisories/2010/0992Broken LinkVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=574105Issue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/58147Third Party AdvisoryVDB Entry
- https://rhn.redhat.com/errata/RHSA-2010-0376.htmlBroken Link
- https://rhn.redhat.com/errata/RHSA-2010-0377.htmlBroken Link
- https://rhn.redhat.com/errata/RHSA-2010-0378.htmlBroken Link
- https://rhn.redhat.com/errata/RHSA-2010-0379.htmlVendor Advisory
- http://marc.info/?l=bugtraq&m=132129312609324&w=2ExploitMailing List
- http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspxThird Party Advisory
FAQ
What is CVE-2010-0738?
CVE-2010-0738 is a vulnerability with a CVSS score of 5.3 (MEDIUM). The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for th...
How severe is CVE-2010-0738?
CVE-2010-0738 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2010-0738?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Jboss Enterprise Application Platform.