Assessment
Why it matters
CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 79.4%; technical severity is CVSS 5.3.
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
Who should care
- Teams operating JBoss, Jboss Enterprise Application Platform
- Vulnerability and exposure management teams
- Security operations teams monitoring exploitation activity
Response plan
What I would do
- Confirm whether JBoss, Jboss Enterprise Application Platform is present in the environment.
- Identify affected versions and establish whether vulnerable services are exposed or reachable.
- Red Hat Security advisory RHSA 2010 0379
- Review relevant security telemetry for evidence of attempted or successful exploitation.
- Document the remediation decision and track it to verified completion.
Treatment intelligence
Remediation intelligence
Vendor sources are listed before government and third-party guidance. Confirm product applicability and change prerequisites before deployment.
Verification noteAutomated link verification has not completed for this guidance yet.
Advisory
- Red Hat Security advisory RHSA 2010 0379Red Hat · Vendor sourceVerification pending ↗
- Red Hat Security advisory Show Bug.cgiRed Hat · Vendor sourceVerification pending ↗
- Red Hat Security advisory RHSA 2010 0376Red Hat · Vendor sourceVerification pending ↗
- Red Hat Security advisory RHSA 2010 0377Red Hat · Vendor sourceVerification pending ↗
- Red Hat Security advisory RHSA 2010 0378Red Hat · Vendor sourceVerification pending ↗
Technical details
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- CWE
- CWE-264
- Affected versions
- Red Hat JBoss; Redhat Jboss Enterprise Application Platform (Version 4.2.0 | Version 4.3.0)
- Fixed versions
- No explicit fixed version is currently recorded.
- Published
- 28 April 2010
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
Signal timeline
- CVE published
- Added to CISA KEV
- Latest EPSS score: 79.4%
- Signal calculated at 81
External references
- CISA Government advisory CVE-2010-0738
- Exploit information from marc.info
- Public Support Unisys Third-party advisory NVD Detail Rpt
- Secunia Technical reference
- Securityreason Technical reference
- Securitytracker Third-party advisory
- Securityfocus Third-party advisory
- Vupen Technical reference
- Exchange Xforce Ibmcloud Third-party advisory