CVE-2008-3273: jboss enterprise_application_platform

CVSS: 5.0v2.0MediumModified

AliasesRHBA-2010:0735

Published 10-08-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-3273 is a medium (CVSS 5.0) vulnerability in jboss enterprise_application_platform. EPSS estimates a 47.11% chance of exploitation in the next 30 days, higher than 98.8% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

39/100

0100

Medium · default modelHow is this calculated?

CVSS score

5.0/10

010

Medium · v2.0 (NVD)

EPSS score

47.11%

0%100%

High · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits2metasploit

Advisory lineage

Upstream 0 · Downstream 4

RHSA-2008:0825 RHSA-2008:0826 RHSA-2008:0827 RHSA-2008:0828

Timeline

10-08-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

JBoss Enterprise Application Platform (aka JBossEAP or EAP) before 4.2.0.CP03, and 4.3.0 before 4.3.0.CP01, allows remote attackers to obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string.

CVSS metrics

1 score · 1 source · 1 version

v2.05.0

EPSS trend

Probability

47.11%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 47.11% on 19-09-2026

19-09-202619-10-2026

EPSS score

47.11%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

MetasploitremoteUnverified
JBoss Status Servlet Information Gathering
auxiliary/scanner/http/jboss_status
Maturity: poc
MetasploitremoteUnverified
JBoss Vulnerability Scanner
auxiliary/scanner/http/jboss_vulnscan
Maturity: poc

Weaknesses

CWE · root cause

CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Affected systems

Redhat199 products

antlr< 0:2.7.6-6.2.2.jdk6.ep5.el5
apache-cxf< 0:2.2.6-1.patch_01.7.jdk6.ep5.el5
apache-james< 0:0.6-5.2.1.jdk6.ep5.el5
avalon-framework< 0:4.1.5-2.2.1.jdk6.ep5.el5
avalon-logkit< 0:1.2-4.3.1.jdk6.ep5.el5

bcel< 0:5.1-16.2.1.2.jdk6.ep5.el5
bsf< 0:2.4.0-2.2.2.jdk6.ep5.el5
bsh< 0:1.3.0-13.2.2.jdk6.ep5.el5
cglib< 0:2.2-5.1.1.1.jdk6.ep5.el5
codehaus-jackson< 0:1.3.5-0.1.jdk6.ep5.el5
codehaus-jackson-core-asl< 0:1.3.5-0.1.jdk6.ep5.el5
codehaus-jackson-core-lgpl< 0:1.3.5-0.1.jdk6.ep5.el5
codehaus-jackson-jaxrs< 0:1.3.5-0.1.jdk6.ep5.el5
codehaus-jackson-mapper-asl< 0:1.3.5-0.1.jdk6.ep5.el5
codehaus-jackson-mapper-lgpl< 0:1.3.5-0.1.jdk6.ep5.el5
codehaus-jackson-xc< 0:1.3.5-0.1.jdk6.ep5.el5
codehaus-stax11< 0:1.1.2-4.2.3.jdk6.ep5.el5
codehaus-stax11-api< 0:1.1.2-4.2.3.jdk6.ep5.el5
concurrent< 0:1.3.4-10.1.1.jdk6.ep5.el5
dom4j< 0:1.6.1-10.4.1.jdk6.ep5.el5
dom4j-demo< 0:1.6.1-10.4.1.jdk6.ep5.el5
dtdparser< 0:1.21-6.1.4.1.jdk6.ep5.el5
ecj3< 1:3.3.1.1-3.1.1.1.jdk6.ep5.el5
facelets< 0:1.1.15-0.b1.4.jdk6.ep5.el5
glassfish-jaf< 0:1.1.0-6.2.1.jdk6.ep5.el5
glassfish-javamail< 0:1.4.2-0.3.2.jdk6.ep5.el5
glassfish-jaxb< 0:2.1.12-5.jdk6.ep5.el5
glassfish-jaxws< 0:2.1.7-0.20.jdk6.ep5.el5
glassfish-jsf< 0:1.2_13-3.1.1.jdk6.ep5.el5
glassfish-jstl< 0:1.2.0-10.6.jdk6.ep5.el5
gnu-getopt< 0:1.0.13-1.1.2.jdk6.ep5.el5
gnu-trove< 0:1.0.2-7.1.1.jdk6.ep5.el5
hibernate3< 1:3.3.2-1.1.GA_CP03.jdk6.ep5.el5
hibernate3-annotations< 0:3.4.0-3.1.GA_CP03.jdk6.ep5.el5
hibernate3-annotations-javadoc< 0:3.4.0-3.1.GA_CP03.jdk6.ep5.el5
hibernate3-commons-annotations< 0:3.1.0-1.7.jdk6.ep5.el5
hibernate3-commons-annotations-javadoc< 0:3.1.0-1.7.jdk6.ep5.el5
hibernate3-ejb-persistence-3.0-api< 1:1.0.2-3.1.jdk6.ep5.el5
hibernate3-ejb-persistence-3.0-api-javadoc< 1:1.0.2-3.1.jdk6.ep5.el5
hibernate3-entitymanager< 0:3.4.0-4.1.GA_CP03.jdk6.ep5.el5
hibernate3-entitymanager-javadoc< 0:3.4.0-4.1.GA_CP03.jdk6.ep5.el5
hibernate3-javadoc< 1:3.3.2-1.1.GA_CP03.jdk6.ep5.el5
hibernate3-search< 0:3.1.1-2.2.GA_CP03.jdk6.ep5.el5
hibernate3-search-javadoc< 0:3.1.1-2.2.GA_CP03.jdk6.ep5.el5
hibernate3-validator< 0:3.1.0-1.5.2.jdk6.ep5.el5
hibernate3-validator-javadoc< 0:3.1.0-1.5.2.jdk6.ep5.el5
hornetq-jopr-plugin< 0:1.0.0-0.CR2.0.jdk6.ep5.el5
hsqldb< 1:1.8.0.8-3.patch03.2.ep5.el5
i18nlog< 0:1.0.10-2.jdk6.ep5.el5
icu4j< 0:3.4.5-2.3.1.jdk6.ep5.el5
isorelax< 1:0-0.4.release20050331.2.1.jdk6.ep5.el5
jacorb-jboss< 0:2.3.1-8.1.jdk6.ep5.el5
jakarta-commons-beanutils< 0:1.8.0-4.1.2.1.jdk6.ep5.el5
jakarta-commons-codec< 0:1.3-9.2.1.1.jdk6.ep5.el5
jakarta-commons-collections< 0:3.2-3.5.1.jdk6.ep5.el5
jakarta-commons-collections-tomcat5< 0:3.2-3.5.1.jdk6.ep5.el5
jakarta-commons-dbcp< 0:1.2.1-16.1.jdk6.ep5.el5
jakarta-commons-dbcp-tomcat5< 0:1.2.1-16.1.jdk6.ep5.el5
jakarta-commons-digester< 0:1.8.1-8.1.jdk6.ep5.el5
jakarta-commons-discovery< 1:0.4-6.1.1.jdk6.ep5.el5
jakarta-commons-el< 0:1.0-19.2.jdk6.ep5.el5
jakarta-commons-httpclient< 1:3.1-1.2.1.jdk6.ep5.el5
jakarta-commons-io< 0:1.4-1.3.1.jdk6.ep5.el5
jakarta-commons-lang< 0:2.4-1.3.1.jdk6.ep5.el5
jakarta-commons-logging< 0:1.1.1-0.4.1.jdk6.ep5.el5
jakarta-commons-logging-jboss< 0:1.1-10.2.1.jdk6.ep5.el5
jakarta-commons-logging-tomcat6< 0:1.1.1-0.4.1.jdk6.ep5.el5
jakarta-commons-parent< 0:11-2.1.jdk6.ep5.el5
jakarta-commons-pool< 0:1.3-11.2.1.jdk6.ep5.el5
jakarta-commons-pool-tomcat5< 0:1.3-11.2.1.jdk6.ep5.el5
jakarta-commons-transaction< 0:1.1-3.2.1.1.jdk6.ep5.el5
jakarta-oro< 0:2.0.8-3.3.2.1.1.1.jdk6.ep5.el5
jakarta-slide-webdavclient< 0:2.1-9.5.1.jdk6.ep5.el5
javacc< 0:4.0-6.1.jdk6.ep5.el5
javassist< 0:3.12.0-1.jdk6.ep5.el5
jaxbintros< 0:1.0.0-1.1.3.2.jdk6.ep5.el5
jaxen< 0:1.1.2-5.1.jdk6.ep5.el5
jboss-aop2< 0:2.1.6-1.CP01.1.1.jdk6.ep5.el5
jboss-aspects-common< 0:1.0.0-0.b1.1.2.1.1.jdk6.ep5.el5
jboss-bootstrap< 0:1.0.1-2.1.1.jdk6.ep5.el5
jboss-cache-core< 0:3.2.5-4.jdk6.ep5.el5
jboss-cache-pojo< 0:3.0.0-4.5.1.1.jdk6.ep5.el5
jboss-cl< 0:2.0.9-1.jdk6.ep5.el5
jboss-cluster-ha-client< 0:1.1.1-1.3.1.jdk6.ep5.el5
jboss-cluster-ha-server-api< 0:1.1.3-1.jdk6.ep5.el5
jboss-cluster-ha-server-cache-jbc< 0:2.0.3-1.jdk6.ep5.el5
jboss-cluster-ha-server-cache-spi< 0:2.0.0-2.3.1.jdk6.ep5.el5
jboss-common-core< 0:2.2.16-3.jdk6.ep5.el5
jboss-common-logging-jdk< 0:2.1.1-1.1.1.jdk6.ep5.el5
jboss-common-logging-log4j< 0:2.1.1-1.1.jdk6.ep5.el5
jboss-common-logging-spi< 0:2.1.1-1.1.jdk6.ep5.el5
jboss-current-invocation-aspects< 0:1.0.1-1.5.1.jdk6.ep5.el5
jboss-deployers< 0:2.0.10-1.jdk6.ep5.el5
jboss-eap5-native< 0:5.1.0-12.1.jdk6.ep5.el5
jboss-ejb-3.0-api< 0:5.0.1-2.6.jdk6.ep5.el5
jboss-ejb3-build< 0:1.0.13-0.2.jdk6.ep5.el5
jboss-ejb3-cache< 0:1.0.0-3.4.1.jdk6.ep5.el5
jboss-ejb3-common< 0:1.0.2-0.2.jdk6.ep5.el5
jboss-ejb3-context< 0:0.1.1-0.4.jdk6.ep5.el5
jboss-ejb3-context-base< 0:0.1.1-0.4.jdk6.ep5.el5
jboss-ejb3-context-naming< 0:0.1.1-0.4.jdk6.ep5.el5
jboss-ejb3-core< 0:1.3.6-0.1.jdk6.ep5.el5
jboss-ejb3-deployers< 0:1.1.4-0.3.jdk6.ep5.el5
jboss-ejb3-endpoint< 0:0.1.0-2.4.1.jdk6.ep5.el5
jboss-ejb3-endpoint-deployer< 0:0.1.4-1.3.1.1.1.jdk6.ep5.el5
jboss-ejb3-ext-api< 0:1.0.0-3.5.1.1.jdk6.ep5.el5
jboss-ejb3-ext-api-impl< 0:1.0.0-3.4.1.jdk6.ep5.el5
jboss-ejb3-interceptors< 0:1.0.7-0.3.jdk6.ep5.el5
jboss-ejb3-jpa-int< 0:1.0.0-1.1.1.1.jdk6.ep5.el5
jboss-ejb3-mc-int< 0:1.0.2-1.1.1.jdk6.ep5.el5
jboss-ejb3-metadata< 0:1.0.0-2.4.1.1.jdk6.ep5.el5
jboss-ejb3-metrics-deployer< 0:1.1.0-0.2.jdk6.ep5.el5
jboss-ejb3-proxy-clustered< 0:1.0.3-1.1.1.1.jdk6.ep5.el5
jboss-ejb3-proxy-impl< 0:1.0.6-1.1.1.1.jdk6.ep5.el5
jboss-ejb3-proxy-spi< 0:1.0.0-1.3.1.1.jdk6.ep5.el5
jboss-ejb3-security< 0:1.0.2-0.2.jdk6.ep5.el5
jboss-ejb3-timeout< 0:0.1.1-0.4.jdk6.ep5.el5
jboss-ejb3-timeout-3.0-api< 0:0.1.1-0.4.jdk6.ep5.el5
jboss-ejb3-timeout-spi< 0:0.1.1-0.4.jdk6.ep5.el5
jboss-ejb3-timerservice-spi< 0:1.0.0-1.4.1.jdk6.ep5.el5
jboss-ejb3-transactions< 0:1.0.2-1.3.1.2.1.jdk6.ep5.el5
jboss-ejb3-vfs< 0:1.0.0-0.alpha1.0.2.jdk6.ep5.el5
jboss-ejb3-vfs-impl-vfs2< 0:1.0.0-0.alpha1.0.2.jdk6.ep5.el5
jboss-ejb3-vfs-spi< 0:1.0.0-0.alpha1.0.2.jdk6.ep5.el5
jboss-el< 0:1.0_02-0.CR5.2.jdk6.ep5.el5
jboss-integration< 0:5.1.0-2.SP1.4.1.1.jdk6.ep5.el5
jboss-jacc-1.1-api< 0:5.0.1-2.6.jdk6.ep5.el5
jboss-jad-1.2-api< 0:5.0.1-2.6.jdk6.ep5.el5
jboss-jaspi-1.0-api< 0:5.0.1-2.6.jdk6.ep5.el5
jboss-javaee< 0:5.0.1-2.6.jdk6.ep5.el5
jboss-javaee-poms< 0:5.0.1-2.6.jdk6.ep5.el5
jboss-jaxr< 0:2.0.1-6.jdk6.ep5.el5
jboss-jca-1.5-api< 0:5.0.1-2.6.jdk6.ep5.el5
jboss-jms-1.1-api< 0:5.0.1-2.6.jdk6.ep5.el5
jboss-jpa-deployers< 0:1.0.0-1.3.2.jdk6.ep5.el5
jboss-logbridge< 0:1.0.0-3.1.jdk6.ep5.el5
jboss-logmanager< 0:1.1.0-2.1.1.jdk6.ep5.el5
jboss-man< 0:2.1.1-4.SP2.1.1.jdk6.ep5.el5
jboss-mdr< 0:2.0.2-3.2.1.jdk6.ep5.el5
jboss-metadata< 0:1.0.6-1.jdk6.ep5.el5
jboss-microcontainer2< 0:2.0.10-3.jdk6.ep5.el5
jboss-naming< 0:5.0.3-2.2.1.jdk6.ep5.el5
jboss-parent< 0:4.0-1.1.jdk6.ep5.el5
jboss-reflect< 0:2.0.3-4.jdk6.ep5.el5
jboss-remoting< 0:2.5.3-4.SP1.3.jdk6.ep5.el5
jboss-remoting-aspects< 0:1.0.3-0.3.jdk6.ep5.el5
jboss-seam-int< 0:5.1.0-1.jdk6.ep5.el5
jboss-seam2< 0:2.2.2.EAP-14.jdk6.ep5.el5
jboss-seam2-docs< 0:2.2.2.EAP-14.jdk6.ep5.el5
jboss-seam2-examples< 0:2.2.2.EAP-14.jdk6.ep5.el5
jboss-seam2-runtime< 0:2.2.2.EAP-14.jdk6.ep5.el5
jboss-security-aspects< 0:1.0.0-2.2.1.jdk6.ep5.el5
jboss-security-negotiation< 0:2.0.3-2.SP3.2.jdk6.ep5.el5
jboss-security-spi< 1:2.0.4-4.SP4.1.jdk6.ep5.el5
jboss-security-xacml< 0:2.0.4-4.1.1.jdk6.ep5.el5
jboss-serialization< 0:1.0.4-0.3.jdk6.ep5.el5
jboss-threads< 0:1.0.0-2.2.1.jdk6.ep5.el5
jboss-transaction-1.0.1-api< 0:5.0.1-2.6.jdk6.ep5.el5
jboss-transaction-aspects< 0:1.0.0-1.4.1.1.jdk6.ep5.el5
jboss-vfs2< 0:2.2.0-2.jdk6.ep5.el5
jboss-xnio-base< 0:1.2.1-3.1.jdk6.ep5.el5
jboss-xnio-metadata< 0:1.0.1-1.3.1.jdk6.ep5.el5
jboss5-libs< 0:5.1.0-1.3.2.1.jdk6.ep5.el5
jbossas-web< 0:5.1.0-52.jdk6.ep5.el5
jbossas-web-5.1.0-bin< 0:5.1.0-52.jdk6.ep5.el5
jbossas-web-client< 0:5.1.0-52.jdk6.ep5.el5
jbossas-web-ws-native< 0:5.1.0-52.jdk6.ep5.el5
jbossas-ws-cxf-ewp< 0:5.1.0-7.jdk6.ep5.el5
jbosssx2< 0:2.0.4-4.SP4.1.jdk6.ep5.el5
jbossts< 1:4.6.1-5.CP07.1.1.jdk6.ep5.el5
jbossts-javadoc< 1:4.6.1-5.CP07.1.1.jdk6.ep5.el5
jbossweb< 0:2.1.10-4.1.jdk6.ep5.el5
jbossweb-jsp-2.1-api< 0:2.1.10-4.1.jdk6.ep5.el5
jbossweb-lib< 0:2.1.10-4.1.jdk6.ep5.el5
jbossweb-servlet-2.5-api< 0:2.1.10-4.1.jdk6.ep5.el5
jbossws< 0:3.1.2-4.SP7.1.1.jdk6.ep5.el5
jbossws-common< 0:1.1.0-2.SP6.1.jdk6.ep5.el5
jbossws-framework< 0:3.1.2-4.SP8.1.1.jdk6.ep5.el5
jbossws-parent< 0:1.0.8-1.jdk6.ep5.el5
jbossws-spi< 0:1.1.2-3.SP4.1.jdk6.ep5.el5
jbossxb2< 0:2.0.1-5.jdk6.ep5.el5
jcip-annotations< 0:1.0-2.2.1.jdk6.ep5.el5
jcommon< 0:1.0.16-1.2.1.jdk6.ep5.el5
jdom< 0:1.0-4.4.jdk6.ep5.el5
jettison< 0:1.1-1.4.jdk6.ep5.el5
jfreechart< 0:1.0.13-2.3.2.1.jdk6.ep5.el5
jgroups< 1:2.6.16-2.jdk6.ep5.el5
joda-time< 0:1.5.2-3.1.jdk6.ep5.el5
joesnmp< 0:0.3.4-3.1.jdk6.ep5.el5
jopr-embedded< 0:1.3.4-16.SP1.5.jdk6.ep5.el5
jopr-hibernate-plugin< 0:3.0.0-8.EmbJopr2.jdk6.ep5.el5
jopr-jboss-as-5-plugin< 0:3.0.0-7.EmbJopr2.jdk6.ep5.el5
jopr-jboss-cache-v3-plugin< 0:3.0.0-6.EmbJopr2.jdk6.ep5.el5
juddi< 0:2.0.1-2.1.jdk6.ep5.el5
jyaml< 0:1.3-3.1.jdk6.ep5.el5
log4j< 0:1.2.14-18.1.jdk6.ep5.el5
mockobjects< 0:0.09-19.1.1.ep5.el5
mockobjects-httpclient< 0:0.09-19.1.1.ep5.el5
mod_cluster< 0:1.0.4-2.1.jdk6.ep5.el5

Show all 199

Jboss1 product

enterprise_application_platform≤ 4.2.0.cp03 | ≤ 4.3.0 | 4.2.0.cp01 | 4.2.0.cp02

2 vendors · 200 products · Showing 200 of 297. Use Open JSON for the complete list.

References

20 links

rhn.redhat.com/errata/RHSA-2008-0828.htmlVendor AdvisoryX Refsource REDHAT
rhn.redhat.com/errata/RHSA-2008-0826.htmlVendor AdvisoryX Refsource REDHAT
marc.info?l=bugtraq&m=132698550418872&w=2Vendor AdvisoryX Refsource HP
www.redhat.com/docs/…X Refsource CONFIRM
exchange.xforce.ibmcloud.com/vulnerabilities/44235VDB EntryX Refsource XF
bugzilla.redhat.com/bugzilla/show_bug.cgi?id=457757X Refsource CONFIRM
www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.3.0.cp01/html-single/readme/X Refsource CONFIRM
rhn.redhat.com/errata/RHSA-2008-0827.htmlVendor AdvisoryX Refsource REDHAT
jira.jboss.org/jira/browse/JBPAPP-544X Refsource CONFIRM
rhn.redhat.com/errata/RHSA-2008-0825.htmlVendor AdvisoryX Refsource REDHAT

Show all 20 references

www.securitytracker.com/id?1020628VDB EntryX Refsource SECTRACK
www.securityfocus.com/bid/30540VDB EntryX Refsource BID
access.redhat.com/errata/RHBA-2010:0735Advisory
docs.redhat.com/docs/…ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=614905REPORT
security.access.redhat.com/data/csaf/v2/advisories/2010/rhba-2010_0735.jsonAdvisory
access.redhat.com/security/cve/CVE-2008-3273REPORT
bugzilla.redhat.com/show_bug.cgi?id=457757REPORT
www.cve.org/CVERecord?id=CVE-2008-3273Advisory
nvd.nist.gov/vuln/detail/CVE-2008-3273Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities