CVE-2010-1428 Red Hat JBoss Information Disclosure
Remote attackers can bypass access controls in the JBoss Web Console by using HTTP methods other than GET or POST to obtain sensitive information.
- Exploited in the wild
- Since 25 May 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2010-1428?
CVE-2010-1428 is a medium-severity missing authorization vulnerability in Redhat Jboss Enterprise Application Platform, published on 28 Apr 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an unspecified request that uses a different method.
Weakness: CWE-749
Which versions are affected by CVE-2010-1428?
It affects 1 product.
Products include Redhat Jboss Enterprise Application Platform.
How do I fix CVE-2010-1428?
Apply the vendor's patch. US federal agencies must fix it by 15 Jun 2022.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2010-1428 being exploited?
Yes. Attackers have exploited CVE-2010-1428 in the wild since at least 25 May 2022, including in ransomware campaigns.
Public exploit code: 1 Metasploit module and 1 Nuclei template.
Other vulnerabilities in Redhat Jboss Enterprise Application Platform
- CVE-2017-12149 Red Hat JBoss Application Server Remote Code Execution
- CVE-2010-0738 Red Hat JBoss Authentication Bypass
- CVE-2016-3690 Deserialization in n/a
- CVE-2017-7504 Deserialization in JBoss
- CVE-2017-7503 XML external entity in JBoss Enterprise Application Platform
All Redhat Jboss Enterprise Application Platform vulnerabilities
Sources
Also known as GHSA-vcwg-4772-7rvx.