CVE-2010-0738
high-risk
Published 2010-04-28
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
Do I need to act?
!
91.3% chance of exploitation in next 30 days
EPSS score — higher than 9% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.3/10
Medium
NETWORK
/ LOW complexity
Affected Products (2)
Affected Vendors
References (27)
Third Party Advisory
http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx...
Broken Link
http://secunia.com/advisories/39563
Broken Link
http://securityreason.com/securityalert/8408
Broken Link
http://securitytracker.com/id?1023918
Broken Link
http://www.securityfocus.com/bid/39710
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=574105
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/58147
Vendor Advisory
https://rhn.redhat.com/errata/RHSA-2010-0379.html
Third Party Advisory
http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx...
Broken Link
http://secunia.com/advisories/39563
Broken Link
http://securityreason.com/securityalert/8408
Broken Link
http://securitytracker.com/id?1023918
Broken Link
http://www.securityfocus.com/bid/39710
and 7 more references
62
/ 100
high-risk
Severity
21/34 · High
Exploitability
34/34 · Critical
Exposure
7/34 · Low