{"id":"CVE-2010-0738","aliases":["EUVD-2010-0764","GHSA-72pp-v9jm-c6xj","RHSA-2010:0376","RHSA-2010:0377","RHSA-2010:0378","RHSA-2010:0379"],"status":"published","title":"The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka...","description":"The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.73815,"percentile":0.99479,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-264","CWE-749"],"published":"2010-04-28T22:00:00Z","modified":"2026-10-02T14:55:30Z","kev":{"date_added":"2022-05-25","due_date":"2022-06-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2022-05-25"},{"source":"kev","since":"2022-05-25"}],"exploits":[{"source":"metasploit","id":"exploit/multi/http/jboss_maindeployer","title":"JBoss JMX Console Deployer Upload and Execute","type":"exploit","platform":"Java,Linux,Windows","date":"2007-02-20","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/jboss_maindeployer"},{"source":"metasploit","id":"exploit/multi/http/jboss_bshdeployer","title":"JBoss JMX Console Beanshell Deployer WAR Upload and Deployment","type":"exploit","platform":"Java,Linux,Windows","date":"2010-04-26","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/jboss_bshdeployer"},{"source":"metasploit","id":"exploit/multi/http/jboss_deploymentfilerepository","title":"JBoss Java Class DeploymentFileRepository WAR Deployment","type":"exploit","platform":"Java,Linux,Windows","date":"2010-04-26","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/jboss_deploymentfilerepository"},{"source":"exploitdb","id":"EDB-16316","title":"JBoss - Java Class DeploymentFileRepository WAR Deployment (Metasploit)","type":"remote","platform":"multiple","date":"2010-08-03","verified":true,"url":"https://www.exploit-db.com/exploits/16316"},{"source":"exploitdb","id":"EDB-16319","title":"JBoss JMX - Console Beanshell Deployer WAR Upload and Deployment (Metasploit)","type":"remote","platform":"multiple","date":"2011-01-10","verified":true,"url":"https://www.exploit-db.com/exploits/16319"},{"source":"exploitdb","id":"EDB-16274","title":"JBoss Application Server 4.2 \u003c 4.2.0.CP09 / 4.3 \u003c 4.3.0.CP08 - Remote Command Execution","type":"webapps","platform":"jsp","date":"2011-03-04","verified":true,"url":"https://www.exploit-db.com/exploits/16274"},{"source":"exploitdb","id":"EDB-17924","title":"JBoss \u0026 JMX Console - Misconfigured Deployment Scanner","type":"webapps","platform":"jsp","date":"2011-10-03","url":"https://www.exploit-db.com/exploits/17924"},{"source":"pocgithub","id":"1872892142/jboss-autopwn-1","title":"1872892142/jboss-autopwn-1","date":"2016-03-08","url":"https://github.com/1872892142/jboss-autopwn-1"},{"source":"pocgithub","id":"gitcollect/jboss-autopwn","title":"gitcollect/jboss-autopwn","date":"2016-07-02","url":"https://github.com/gitcollect/jboss-autopwn"},{"source":"nuclei","id":"CVE-2010-0738","title":"JBoss JMX/Web Console - Authentication Bypass via HTTP Verb Tampering","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-0738.yaml"},{"source":"metasploit","id":"auxiliary/admin/http/jboss_bshdeployer","title":"JBoss JMX Console Beanshell Deployer WAR Upload and Deployment","type":"auxiliary","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/admin/http/jboss_bshdeployer"},{"source":"metasploit","id":"auxiliary/admin/http/jboss_deploymentfilerepository","title":"JBoss JMX Console DeploymentFileRepository WAR Upload and Deployment","type":"auxiliary","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/admin/http/jboss_deploymentfilerepository"},{"source":"metasploit","id":"auxiliary/scanner/http/jboss_vulnscan","title":"JBoss Vulnerability Scanner","type":"auxiliary","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/http/jboss_vulnscan"},{"source":"metasploit","id":"auxiliary/scanner/sap/sap_icm_urlscan","title":"SAP URL Scanner","type":"auxiliary","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/sap/sap_icm_urlscan"}],"affected":[{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"hibernate3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"hibernate3-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-1.12.GA_CP03.ep1.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"hibernate3-annotations-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-1.12.GA_CP03.ep1.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"hibernate3-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"hsqldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8-3.patch03.1jpp.ep1.3.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jacorb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0-1jpp.ep1.10.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.1-1.patch01.1jpp.ep1.4.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jboss-aop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.5-3.CP05.2.ep1.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jboss-cache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-6.SP14.1.ep1.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jboss-remoting","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.3-3.SP2.ep1.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jboss-seam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.ep1.24.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jboss-seam-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.ep1.24.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jbossas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0-6.GA_CP09.6.ep1.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jbossas-4.2.0.GA_CP09-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0-6.GA_CP09.6.ep1.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jbossas-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0-6.GA_CP09.6.ep1.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jbossts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.3-1.SP5_CP09.1jpp.ep1.1.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-6.CP13.0jpp.ep1.1.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"rh-eap-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0-7.GA_CP09.ep1.5.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"rh-eap-docs-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0-7.GA_CP09.ep1.5.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"hibernate3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"hibernate3-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-1.12.GA_CP03.ep1.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"hibernate3-annotations-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-1.12.GA_CP03.ep1.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"hibernate3-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"hsqldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8-3.patch03.1jpp.ep1.3.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jacorb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0-1jpp.ep1.10.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jakarta-commons-httpclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.1-1.patch01.1jpp.ep1.4.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jboss-aop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.5-3.CP05.2.ep1.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jboss-cache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-6.SP14.1.ep1.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jboss-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.0-3.SP3_CP10.2.ep1.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jboss-remoting","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.3-3.SP2.ep1.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jboss-seam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jboss-seam-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jboss-seam2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2.FP-1.ep1.23.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jboss-seam2-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2.FP-1.ep1.23.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jbossas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-7.GA_CP08.5.ep1.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jbossas-4.3.0.GA_CP08-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-7.GA_CP08.5.ep1.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jbossas-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-7.GA_CP08.5.ep1.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jbossts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.3-1.SP5_CP09.1jpp.ep1.1.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-6.CP13.0jpp.ep1.1.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jbossws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-5.SP2_CP08.1.ep1.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"rh-eap-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-7.GA_CP08.ep1.6.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"rh-eap-docs-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-7.GA_CP08.ep1.6.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"hibernate3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"hibernate3-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-1.12.GA_CP03.ep1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"hibernate3-annotations-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-1.12.GA_CP03.ep1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"hibernate3-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jacorb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0-1jpp.ep1.10.1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jboss-aop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.5-3.CP05.2.ep1.1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jboss-cache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-6.SP14.1.ep1.1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jboss-remoting","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.3-3.SP2.ep1.1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jboss-seam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.ep1.24.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jboss-seam-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.ep1.24.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jbossas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0-6.GA_CP09.6.ep1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jbossas-4.2.0.GA_CP09-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0-6.GA_CP09.6.ep1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jbossas-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0-6.GA_CP09.6.ep1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jbossts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.3-1.SP5_CP09.1jpp.ep1.1.1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-6.CP13.0jpp.ep1.1.1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"rh-eap-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0-7.GA_CP09.ep1.4.1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"rh-eap-docs-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0-7.GA_CP09.ep1.4.1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"hibernate3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"hibernate3-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-1.12.GA_CP03.ep1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"hibernate3-annotations-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-1.12.GA_CP03.ep1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"hibernate3-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jacorb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0-1jpp.ep1.10.1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jboss-aop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.5-3.CP05.2.ep1.1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jboss-cache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-6.SP14.1.ep1.1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jboss-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.0-3.SP3_CP10.2.ep1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jboss-remoting","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.3-3.SP2.ep1.1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jboss-seam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jboss-seam-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jboss-seam2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2.FP-1.ep1.23.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jboss-seam2-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2.FP-1.ep1.23.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jbossas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-7.GA_CP08.5.ep1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jbossas-4.3.0.GA_CP08-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-7.GA_CP08.5.ep1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jbossas-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-7.GA_CP08.5.ep1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jbossts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.3-1.SP5_CP09.1jpp.ep1.1.1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-6.CP13.0jpp.ep1.1.1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jbossws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-5.SP2_CP08.1.ep1.1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"rh-eap-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-7.GA_CP08.ep1.5.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"rh-eap-docs-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-7.GA_CP08.ep1.5.el5"}]}],"bundled":3}],"products":[{"vendor":"red hat","product":"jboss"},{"vendor":"redhat","product":"jboss_enterprise_application_platform"}],"references":[{"url":"https://rhn.redhat.com/errata/RHSA-2010-0379.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"https://rhn.redhat.com/errata/RHSA-2010-0378.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Broken Link"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=574105","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"https://rhn.redhat.com/errata/RHSA-2010-0376.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Broken Link"]},{"url":"http://securityreason.com/securityalert/8408","tags":["third-party-advisory","x_refsource_SREASON","x_transferred","Broken Link"]},{"url":"https://rhn.redhat.com/errata/RHSA-2010-0377.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Broken Link"]},{"url":"http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=35","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/0992","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Broken Link","Vendor Advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=132129312609324\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Exploit","Mailing List"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/58147","tags":["vdb-entry","x_refsource_XF","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/39710","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://secunia.com/advisories/39563","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Vendor Advisory"]},{"url":"http://securitytracker.com/id?1023918","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-0738","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-0738","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2010:0376","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2010:0377","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2010:0378","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2010:0379","tags":["advisory"]},{"url":"https://access.redhat.com/kb/docs/DOC-30741","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-0738","tags":["report"]},{"url":"https://github.com/advisories/GHSA-72pp-v9jm-c6xj"},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=571813","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=585899","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=585900","tags":["report"]},{"url":"http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.2.0.cp09/html-single/Release_Notes/index.html","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0376.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-0738","tags":["advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-1428","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-1428","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-1428","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-1429","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-1429","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-1429","tags":["advisory"]},{"url":"http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.3.0.cp08/html-single/Release_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=571828","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0377.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=571835","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0378.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=571905","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0379.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2010-0738","description":"The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.","status":"published","published":"2010-04-28T22:00:00Z","modified":"2026-10-01T19:23:44.44Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-749"],"updated_at":"2026-11-02T14:33:29.990758Z"}],"euvd":[{"id":"EUVD-2010-0764","description":"The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.","status":"published","published":"2010-04-28T22:00:00Z","modified":"2026-10-01T19:23:44Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"exploited_since":"2022-05-25","updated_at":"2026-11-02T17:27:43.966642Z"}],"ghsa":[{"id":"GHSA-72pp-v9jm-c6xj","title":"The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka...","description":"The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.","status":"published","published":"2022-05-02T06:15:13Z","modified":"2025-10-22T03:31:03Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-749"],"updated_at":"2026-11-02T15:04:09.266545Z"}],"kev":[{"id":"CVE-2010-0738","title":"Red Hat JBoss Authentication Bypass Vulnerability","description":"The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.","cwes":["CWE-264"],"kev":{"date_added":"2022-05-25","due_date":"2022-06-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2010-0738","description":"The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.","status":"published","published":"2010-04-28T22:30:00.447Z","modified":"2026-10-02T14:55:30.687Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-749"],"updated_at":"2026-11-02T14:01:45.97784Z"}],"osv":[{"id":"RHSA-2010:0376","title":"Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0.CP09 update","status":"published","published":"2024-09-15T18:21:43Z","modified":"2026-01-08T10:29:49.311549Z","updated_at":"2026-11-02T15:53:00.468834Z"},{"id":"RHSA-2010:0377","title":"Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0.CP08 update","status":"published","published":"2024-09-15T18:21:47Z","modified":"2026-01-14T11:04:07.787022Z","updated_at":"2026-11-02T15:53:00.468834Z"},{"id":"RHSA-2010:0378","title":"Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0.CP09 update","status":"published","published":"2024-09-15T18:21:52Z","modified":"2026-01-14T11:04:07.844127Z","updated_at":"2026-11-02T15:53:00.468834Z"},{"id":"RHSA-2010:0379","title":"Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0.CP08 update","status":"published","published":"2024-09-15T18:21:56Z","modified":"2026-01-14T11:04:07.940272Z","updated_at":"2026-11-02T15:53:00.468834Z"}]}}