CVE-2010-1429 Information disclosure in n/a
Remote attackers can obtain sensitive information about deployed web contexts via the status servlet in JBoss EAP.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2010-1429?
CVE-2010-1429 is a medium-severity vulnerability in Redhat Jboss Enterprise Application Platform, published on 28 Apr 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 allows remote attackers to obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string. NOTE: this issue exists because of a CVE-2008-3273 regression.
Weakness: CWE-264
Which versions are affected by CVE-2010-1429?
It affects 1 product.
Products include Redhat Jboss Enterprise Application Platform.
How do I fix CVE-2010-1429?
Upgrade to a fixed version.
Is CVE-2010-1429 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2010-1429 exists.
Public exploit code: 2 Metasploit modules and 1 Nuclei template.
Other vulnerabilities in Redhat Jboss Enterprise Application Platform
- CVE-2017-12149 Red Hat JBoss Application Server Remote Code Execution
- CVE-2010-1428 Red Hat JBoss Information Disclosure
- CVE-2010-0738 Red Hat JBoss Authentication Bypass
- CVE-2016-3690 Deserialization in n/a
- CVE-2017-7504 Deserialization in JBoss
All Redhat Jboss Enterprise Application Platform vulnerabilities
Sources
Also known as GHSA-x26p-67q3-4mfx.