CVE-2010-0738
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka...
5.3 MediumIn KEVPublic exploit
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
73.8%Down 9.4 points since Feb 4, 2022
What each source reports
NVD Score used
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
- Record
CVE-2010-0738- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-749
- Updated
- 2026-11-02
CVE List
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
- Record
CVE-2010-0738- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-749
- Updated
- 2026-11-02
EUVDEUVD-2010-0764
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
- Record
EUVD-2010-0764- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-72pp-v9jm-c6xj
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka...
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
- Record
GHSA-72pp-v9jm-c6xj- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-749
- Updated
- 2026-11-02
CISA KEV No score
Red Hat JBoss Authentication Bypass Vulnerability
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
- Record
CVE-2010-0738- Weakness
- CWE-264
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
hibernate3Red Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 3 CVEs |
before 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el4 | 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el4 |
hibernate3-annotationsRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 3 CVEs |
before 0:3.3.1-1.12.GA_CP03.ep1.el4 | 0:3.3.1-1.12.GA_CP03.ep1.el4 |
hibernate3-annotations-javadocRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 3 CVEs |
before 0:3.3.1-1.12.GA_CP03.ep1.el4 | 0:3.3.1-1.12.GA_CP03.ep1.el4 |
hibernate3-javadocRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 3 CVEs |
before 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el4 | 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el4 |
hsqldbRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 3 CVEs |
before 1:1.8.0.8-3.patch03.1jpp.ep1.3.el4 | 1:1.8.0.8-3.patch03.1jpp.ep1.3.el4 |
jacorbRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 3 CVEs |
before 0:2.3.0-1jpp.ep1.10.el4 | 0:2.3.0-1jpp.ep1.10.el4 |
jakarta-commons-httpclientRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 3 CVEs |
before 1:3.0.1-1.patch01.1jpp.ep1.4.el4 | 1:3.0.1-1.patch01.1jpp.ep1.4.el4 |
jboss-aopRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 3 CVEs |
before 0:1.5.5-3.CP05.2.ep1.el4 | 0:1.5.5-3.CP05.2.ep1.el4 |
jboss-cacheRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 3 CVEs |
before 0:1.4.1-6.SP14.1.ep1.el4 | 0:1.4.1-6.SP14.1.ep1.el4 |
jboss-remotingRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 3 CVEs |
before 0:2.2.3-3.SP2.ep1.el4 | 0:2.2.3-3.SP2.ep1.el4 |
Show 70 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jboss-seamRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 3 CVEs |
before 0:1.2.1-1.ep1.24.el4 | 0:1.2.1-1.ep1.24.el4 |
jboss-seam-docsRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 3 CVEs |
before 0:1.2.1-1.ep1.24.el4 | 0:1.2.1-1.ep1.24.el4 |
jbossasRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 3 CVEs |
before 0:4.2.0-6.GA_CP09.6.ep1.el4 | 0:4.2.0-6.GA_CP09.6.ep1.el4 |
jbossas-4.2.0.GA_CP09-binRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 3 CVEs |
before 0:4.2.0-6.GA_CP09.6.ep1.el4 | 0:4.2.0-6.GA_CP09.6.ep1.el4 |
jbossas-clientRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 3 CVEs |
before 0:4.2.0-6.GA_CP09.6.ep1.el4 | 0:4.2.0-6.GA_CP09.6.ep1.el4 |
jbosstsRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 3 CVEs |
before 1:4.2.3-1.SP5_CP09.1jpp.ep1.1.el4 | 1:4.2.3-1.SP5_CP09.1jpp.ep1.1.el4 |
jbosswebRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 3 CVEs |
before 0:2.0.0-6.CP13.0jpp.ep1.1.el4 | 0:2.0.0-6.CP13.0jpp.ep1.1.el4 |
rh-eap-docsRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 3 CVEs |
before 0:4.2.0-7.GA_CP09.ep1.5.el4 | 0:4.2.0-7.GA_CP09.ep1.5.el4 |
rh-eap-docs-examplesRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 3 CVEs |
before 0:4.2.0-7.GA_CP09.ep1.5.el4 | 0:4.2.0-7.GA_CP09.ep1.5.el4 |
hibernate3Red Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el4 | 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el4 |
hibernate3-annotationsRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:3.3.1-1.12.GA_CP03.ep1.el4 | 0:3.3.1-1.12.GA_CP03.ep1.el4 |
hibernate3-annotations-javadocRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:3.3.1-1.12.GA_CP03.ep1.el4 | 0:3.3.1-1.12.GA_CP03.ep1.el4 |
hibernate3-javadocRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el4 | 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el4 |
hsqldbRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 1:1.8.0.8-3.patch03.1jpp.ep1.3.el4 | 1:1.8.0.8-3.patch03.1jpp.ep1.3.el4 |
jacorbRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:2.3.0-1jpp.ep1.10.el4 | 0:2.3.0-1jpp.ep1.10.el4 |
jakarta-commons-httpclientRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 1:3.0.1-1.patch01.1jpp.ep1.4.el4 | 1:3.0.1-1.patch01.1jpp.ep1.4.el4 |
jboss-aopRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:1.5.5-3.CP05.2.ep1.el4 | 0:1.5.5-3.CP05.2.ep1.el4 |
jboss-cacheRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:1.4.1-6.SP14.1.ep1.el4 | 0:1.4.1-6.SP14.1.ep1.el4 |
jboss-messagingRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:1.4.0-3.SP3_CP10.2.ep1.el4 | 0:1.4.0-3.SP3_CP10.2.ep1.el4 |
jboss-remotingRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:2.2.3-3.SP2.ep1.el4 | 0:2.2.3-3.SP2.ep1.el4 |
jboss-seamRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el4 | 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el4 |
jboss-seam-docsRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el4 | 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el4 |
jboss-seam2Red Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:2.0.2.FP-1.ep1.23.el4 | 0:2.0.2.FP-1.ep1.23.el4 |
jboss-seam2-docsRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:2.0.2.FP-1.ep1.23.el4 | 0:2.0.2.FP-1.ep1.23.el4 |
jbossasRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:4.3.0-7.GA_CP08.5.ep1.el4 | 0:4.3.0-7.GA_CP08.5.ep1.el4 |
jbossas-4.3.0.GA_CP08-binRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:4.3.0-7.GA_CP08.5.ep1.el4 | 0:4.3.0-7.GA_CP08.5.ep1.el4 |
jbossas-clientRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:4.3.0-7.GA_CP08.5.ep1.el4 | 0:4.3.0-7.GA_CP08.5.ep1.el4 |
jbosstsRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 1:4.2.3-1.SP5_CP09.1jpp.ep1.1.el4 | 1:4.2.3-1.SP5_CP09.1jpp.ep1.1.el4 |
jbosswebRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:2.0.0-6.CP13.0jpp.ep1.1.el4 | 0:2.0.0-6.CP13.0jpp.ep1.1.el4 |
jbosswsRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:2.0.1-5.SP2_CP08.1.ep1.el4 | 0:2.0.1-5.SP2_CP08.1.ep1.el4 |
rh-eap-docsRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:4.3.0-7.GA_CP08.ep1.6.el4 | 0:4.3.0-7.GA_CP08.ep1.6.el4 |
rh-eap-docs-examplesRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:4.3.0-7.GA_CP08.ep1.6.el4 | 0:4.3.0-7.GA_CP08.ep1.6.el4 |
hibernate3Red Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 3 CVEs |
before 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el5 | 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el5 |
hibernate3-annotationsRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 3 CVEs |
before 0:3.3.1-1.12.GA_CP03.ep1.el5 | 0:3.3.1-1.12.GA_CP03.ep1.el5 |
hibernate3-annotations-javadocRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 3 CVEs |
before 0:3.3.1-1.12.GA_CP03.ep1.el5 | 0:3.3.1-1.12.GA_CP03.ep1.el5 |
hibernate3-javadocRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 3 CVEs |
before 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el5 | 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el5 |
jacorbRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 3 CVEs |
before 0:2.3.0-1jpp.ep1.10.1.el5 | 0:2.3.0-1jpp.ep1.10.1.el5 |
jboss-aopRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 3 CVEs |
before 0:1.5.5-3.CP05.2.ep1.1.el5 | 0:1.5.5-3.CP05.2.ep1.1.el5 |
jboss-cacheRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 3 CVEs |
before 0:1.4.1-6.SP14.1.ep1.1.el5 | 0:1.4.1-6.SP14.1.ep1.1.el5 |
jboss-remotingRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 3 CVEs |
before 0:2.2.3-3.SP2.ep1.1.el5 | 0:2.2.3-3.SP2.ep1.1.el5 |
jboss-seamRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 3 CVEs |
before 0:1.2.1-1.ep1.24.el5 | 0:1.2.1-1.ep1.24.el5 |
jboss-seam-docsRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 3 CVEs |
before 0:1.2.1-1.ep1.24.el5 | 0:1.2.1-1.ep1.24.el5 |
jbossasRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 3 CVEs |
before 0:4.2.0-6.GA_CP09.6.ep1.el5 | 0:4.2.0-6.GA_CP09.6.ep1.el5 |
jbossas-4.2.0.GA_CP09-binRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 3 CVEs |
before 0:4.2.0-6.GA_CP09.6.ep1.el5 | 0:4.2.0-6.GA_CP09.6.ep1.el5 |
jbossas-clientRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 3 CVEs |
before 0:4.2.0-6.GA_CP09.6.ep1.el5 | 0:4.2.0-6.GA_CP09.6.ep1.el5 |
jbosstsRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 3 CVEs |
before 1:4.2.3-1.SP5_CP09.1jpp.ep1.1.1.el5 | 1:4.2.3-1.SP5_CP09.1jpp.ep1.1.1.el5 |
jbosswebRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 3 CVEs |
before 0:2.0.0-6.CP13.0jpp.ep1.1.1.el5 | 0:2.0.0-6.CP13.0jpp.ep1.1.1.el5 |
rh-eap-docsRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 3 CVEs |
before 0:4.2.0-7.GA_CP09.ep1.4.1.el5 | 0:4.2.0-7.GA_CP09.ep1.4.1.el5 |
rh-eap-docs-examplesRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 3 CVEs |
before 0:4.2.0-7.GA_CP09.ep1.4.1.el5 | 0:4.2.0-7.GA_CP09.ep1.4.1.el5 |
hibernate3Red Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el5 | 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el5 |
hibernate3-annotationsRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:3.3.1-1.12.GA_CP03.ep1.el5 | 0:3.3.1-1.12.GA_CP03.ep1.el5 |
hibernate3-annotations-javadocRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:3.3.1-1.12.GA_CP03.ep1.el5 | 0:3.3.1-1.12.GA_CP03.ep1.el5 |
hibernate3-javadocRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el5 | 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el5 |
jacorbRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:2.3.0-1jpp.ep1.10.1.el5 | 0:2.3.0-1jpp.ep1.10.1.el5 |
jboss-aopRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:1.5.5-3.CP05.2.ep1.1.el5 | 0:1.5.5-3.CP05.2.ep1.1.el5 |
jboss-cacheRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:1.4.1-6.SP14.1.ep1.1.el5 | 0:1.4.1-6.SP14.1.ep1.1.el5 |
jboss-messagingRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:1.4.0-3.SP3_CP10.2.ep1.el5 | 0:1.4.0-3.SP3_CP10.2.ep1.el5 |
jboss-remotingRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:2.2.3-3.SP2.ep1.1.el5 | 0:2.2.3-3.SP2.ep1.1.el5 |
jboss-seamRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el5.1 | 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el5.1 |
jboss-seam-docsRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el5.1 | 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el5.1 |
jboss-seam2Red Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:2.0.2.FP-1.ep1.23.el5 | 0:2.0.2.FP-1.ep1.23.el5 |
jboss-seam2-docsRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:2.0.2.FP-1.ep1.23.el5 | 0:2.0.2.FP-1.ep1.23.el5 |
jbossasRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:4.3.0-7.GA_CP08.5.ep1.el5 | 0:4.3.0-7.GA_CP08.5.ep1.el5 |
jbossas-4.3.0.GA_CP08-binRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:4.3.0-7.GA_CP08.5.ep1.el5 | 0:4.3.0-7.GA_CP08.5.ep1.el5 |
jbossas-clientRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:4.3.0-7.GA_CP08.5.ep1.el5 | 0:4.3.0-7.GA_CP08.5.ep1.el5 |
jbosstsRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 1:4.2.3-1.SP5_CP09.1jpp.ep1.1.1.el5 | 1:4.2.3-1.SP5_CP09.1jpp.ep1.1.1.el5 |
jbosswebRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:2.0.0-6.CP13.0jpp.ep1.1.1.el5 | 0:2.0.0-6.CP13.0jpp.ep1.1.1.el5 |
jbosswsRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:2.0.1-5.SP2_CP08.1.ep1.1.el5 | 0:2.0.1-5.SP2_CP08.1.ep1.1.el5 |
rh-eap-docsRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:4.3.0-7.GA_CP08.ep1.5.el5 | 0:4.3.0-7.GA_CP08.ep1.5.el5 |
rh-eap-docs-examplesRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:4.3.0-7.GA_CP08.ep1.5.el5 | 0:4.3.0-7.GA_CP08.ep1.5.el5 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | JBoss JMX Console Deployer Upload and Execute | 2007-02-20 |
| Metasploit | JBoss JMX Console Beanshell Deployer WAR Upload and Deployment | 2010-04-26 |
| Metasploit | JBoss Java Class DeploymentFileRepository WAR Deployment | 2010-04-26 |
| Exploit-DB | JBoss - Java Class DeploymentFileRepository WAR Deployment (Metasploit) | 2010-08-03 |
| Exploit-DB | JBoss JMX - Console Beanshell Deployer WAR Upload and Deployment (Metasploit) | 2011-01-10 |
| Exploit-DB | JBoss Application Server 4.2 < 4.2.0.CP09 / 4.3 < 4.3.0.CP08 - Remote Command Execution | 2011-03-04 |
| Exploit-DB | JBoss & JMX Console - Misconfigured Deployment Scanner | 2011-10-03 |
| PoC in GitHub | 1872892142/jboss-autopwn-1 | 2016-03-08 |
| PoC in GitHub | gitcollect/jboss-autopwn | 2016-07-02 |
| Nuclei | JBoss JMX/Web Console - Authentication Bypass via HTTP Verb Tampering |
Show 4 moreShow less
| Source | Link | Date |
|---|---|---|
| Metasploit | JBoss JMX Console Beanshell Deployer WAR Upload and Deployment | |
| Metasploit | JBoss JMX Console DeploymentFileRepository WAR Upload and Deployment | |
| Metasploit | JBoss Vulnerability Scanner | |
| Metasploit | SAP URL Scanner |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-0738 is a medium vulnerability (CVSS 5.3) in Red Hat Jboss, published April 28, 2010. CISA lists it as known to be exploited, since May 25, 2022. EUVD reports exploitation since May 25, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 73.8%, the 99th percentile. No source names a fixed version.
References
rhn.redhat.com/errata/RHSA-2010-0379.html
bugzilla.redhat.com/show_bug.cgi?id=574105
securityreason.com/securityalert/8408
Show 37 moreShow less
public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=35
vupen.com/english/advisories/2010/0992
marc.info?l=bugtraq&m=132129312609324&w=2
exchange.xforce.ibmcloud.com/vulnerabilities/58147
securityfocus.com/bid/39710
secunia.com/advisories/39563
securitytracker.com/id?1023918
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-0738
nvd.nist.gov/vuln/detail/CVE-2010-0738
access.redhat.com/errata/RHSA-2010:0376
github.com/advisories/GHSA-72pp-v9jm-c6xj
redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.2.0.cp09/html-single/Release_Notes/index.html
security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0376.json
cve.org/CVERecord?id=CVE-2010-0738