CVE-2010-0738 Red Hat JBoss Authentication Bypass

Exploited in the wild Low 3.7 Published 28 Apr 2010 Updated 1 Oct 2026

Remote attackers can bypass access controls on the JMX-Console by using HTTP methods other than GET or POST, potentially exposing management interfaces.

Exploited in the wild: Since 25 May 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2010-0738?

CVE-2010-0738 is a low-severity missing authorization vulnerability in Redhat Jboss Enterprise Application Platform, published on 28 Apr 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.

Weakness: CWE-749

Which versions are affected by CVE-2010-0738?

It affects 1 product.

Products include Redhat Jboss Enterprise Application Platform.

How do I fix CVE-2010-0738?

Apply the vendor's patch. US federal agencies must fix it by 15 Jun 2022.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2010-0738 being exploited?

Yes. Attackers have exploited CVE-2010-0738 in the wild since at least 25 May 2022, including in ransomware campaigns.

Public exploit code: 7 Metasploit modules, 4 Exploit-DB entries, 1 Nuclei template and 2 proofs of concept on GitHub.

All Redhat Jboss Enterprise Application Platform vulnerabilities

Sources

Also known as GHSA-72pp-v9jm-c6xj.