CVE-2010-1428: Red Hat JBoss Information Disclosure Vulnerability

Vulnerability summary

CVE-2010-1428 is a high (CVSS 7.5) Exposed Dangerous Method or Function vulnerability in Red Hat JBoss. It is known to be exploited: CISA lists it, first on 25-05-2022. It has been used in ransomware campaigns. EPSS estimates a 52.65% chance of exploitation in the next 30 days, higher than 98.9% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 28-04-2010
   PublishedVulnerability first disclosed.
2. 25-05-2022
   Added to CISA KEVExploitedRed Hat JBoss Information Disclosure Vulnerability
3. 15-06-2022
   CISA remediation dueDeadline passedApply updates per vendor instructions.
4. 01-10-2026
   Last modifiedVulnerability information updated.

Description

The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an unspecified request that uses a different method.

• CWE-749Exposed Dangerous Method or FunctionThe product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.