5.9Mittel
KEV
In Ransomware genutzt
CVE-2010-1428Red Hat JBoss Information Disclosure Vulnerability
Bekannt ausgenutzt — Red Hat JBoss Information Disclosure Vulnerability
CISA hat am 25.05.2022 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 15.06.2022.
Erforderliche Maßnahme: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2010-1428
Beschreibung
The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an unspecified request that uses a different method.
Schwachstellentyp (CWE):
CWE-749
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| redhat | jboss enterprise application platform | 4.2.0 |
Referenzen und Patches
- RHSA-2010:0379 vendor-advisoryVendor Advisory
- RHSA-2010:0378 vendor-advisoryBroken Link
- jboss-webconsole-information-disclosure(58148) vdb-entryThird Party AdvisoryVDB Entry
- HPSBMU02736 vendor-advisoryExploitMailing List
- RHSA-2010:0376 vendor-advisoryBroken LinkVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=585899 Issue Tracking
- RHSA-2010:0377 vendor-advisoryBroken Link
- ADV-2010-0992 vdb-entryBroken LinkVendor Advisory
- 1023917 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- 39710 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- 39563 third-party-advisoryBroken LinkVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-1428 Broken Link
CPE-Treffer (NVD) (2)
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:-:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:-:*:*:*:*:*:*