5.9Orta
KEV
Fidye yazılımında kullanılıyor
CVE-2010-1428Red Hat JBoss Information Disclosure Vulnerability
Aktif olarak istismar ediliyor — Red Hat JBoss Information Disclosure Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 25.05.2022 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 15.06.2022.
Gerekli işlem: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2010-1428
Açıklama
The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an unspecified request that uses a different method.
Zayıflık türü (CWE):
CWE-749
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| redhat | jboss enterprise application platform | 4.2.0 |
Kaynaklar ve yamalar
- RHSA-2010:0379 vendor-advisoryVendor Advisory
- RHSA-2010:0378 vendor-advisoryBroken Link
- jboss-webconsole-information-disclosure(58148) vdb-entryThird Party AdvisoryVDB Entry
- HPSBMU02736 vendor-advisoryExploitMailing List
- RHSA-2010:0376 vendor-advisoryBroken LinkVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=585899 Issue Tracking
- RHSA-2010:0377 vendor-advisoryBroken Link
- ADV-2010-0992 vdb-entryBroken LinkVendor Advisory
- 1023917 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- 39710 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- 39563 third-party-advisoryBroken LinkVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-1428 Broken Link
CPE eşleşmeleri (NVD) (2)
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:-:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:-:*:*:*:*:*:*