CVE Feed

    Dashboard / CVE / CVE-2010-1428

    CVE-2010-1428

    The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an unspecified request that uses a different method.

    Published:Apr 26, 2010
    Last Modified:Oct 1, 2026
    EPS:Apr 28, 2010
    EPSS Score:0.62052
    CVSS Score:5.9

    CISA Notification

    Description

    The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an unspecified request that uses a different method.

    Required Action:

    Apply updates per vendor instructions.

    Notes:

    No extra notes provided.

    Due Date
    Jun 15, 2022
    1604 days ago
    Alert Date
    May 25, 2022
    1625 days ago

    Affected Products

    Vendor
    Redhat
    Product
    Jboss Enterprise Application Platform

    Exploits

    http://marc.info/?l=bugtraq&m=132698550418872&w=2http://marc.info/?l=bugtraq&m=132698550418872&w=2

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-500 WebView Injection

    Related CVEs

    CVE-2026-96453 (CVSS 8) — A flaw was found in the Keycloak Admin CLI kcadm tool, which is used by administrators to manage Keycloak serv…
    CVE-2026-93998 (CVSS 7.4) — A flaw was found in the SAML adapter component of Keycloak, which is used to secure applications with SAML-bas…
    CVE-2026-120971 (CVSS 5.3) — A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicati…
    CVE-2026-119542 (CVSS 4.3) — A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can caus…
    CVE-2026-91920 (CVSS 6.5) — A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked tran…
    CVE-2026-84725 (CVSS 8.1) — when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during obj…
    CVE-2026-15564 (CVSS 7.4) — Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An att…
    CVE-2026-114488 (CVSS 7.4) — A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 …
    CVE-2026-19610 (CVSS 6.5) — A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level m…
    CVE-2026-114370 (CVSS 3.7) — A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsibl…

    References

    http://marc.info/?l=bugtraq&m=132698550418872&w=2
    http://secunia.com/advisories/39563
    http://securitytracker.com/id?1023917
    http://www.securityfocus.com/bid/39710
    http://www.vupen.com/english/advisories/2010/0992
    https://bugzilla.redhat.com/show_bug.cgi?id=585899
    https://exchange.xforce.ibmcloud.com/vulnerabilities/58148
    https://rhn.redhat.com/errata/RHSA-2010-0376.html
    https://rhn.redhat.com/errata/RHSA-2010-0377.html
    https://rhn.redhat.com/errata/RHSA-2010-0378.html
    https://rhn.redhat.com/errata/RHSA-2010-0379.html
    http://marc.info/?l=bugtraq&m=132698550418872&w=2
    http://secunia.com/advisories/39563
    http://securitytracker.com/id?1023917
    http://www.securityfocus.com/bid/39710
    http://www.vupen.com/english/advisories/2010/0992
    https://bugzilla.redhat.com/show_bug.cgi?id=585899
    https://exchange.xforce.ibmcloud.com/vulnerabilities/58148
    https://rhn.redhat.com/errata/RHSA-2010-0376.html
    https://rhn.redhat.com/errata/RHSA-2010-0377.html
    https://rhn.redhat.com/errata/RHSA-2010-0378.html
    https://rhn.redhat.com/errata/RHSA-2010-0379.html
    https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-1428

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High