Red Hat JBoss EAP JMX-Console HTTP Verb Tampering Authentication Bypass (CVE-2010-0738)
Executive & SecOps Summary
SECOPS ASSESSMENTRed Hat JBoss Enterprise Application Platform (JBoss EAP) 4.2 (prior to 4.2.0.CP09) and 4.3 (prior to 4.3.0.CP08).
Remote attackers can bypass authentication on the JMX-Console by utilizing non-standard HTTP methods (such as HEAD), allowing unauthorized administrative actions.
Apply the official Cumulative Patch (CP), or modify the web.xml configuration to enforce authentication across all HTTP methods.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrade your JBoss EAP installation to the latest Cumulative Patch (4.2.0.CP09 / 4.3.0.CP08 or higher) as recommended by Red Hat.
# Example: Update JBoss packages on RHEL-based systems
yum update jbossas-jboss-eap -y
systemctl restart jbossas2. Temporary Workaround & Hardening Configuration
If patching is not immediately feasible, secure the JMX-Console by removing the <http-method> restrictions from web.xml to force authentication on all HTTP methods.
<!-- Edit $JBOSS_HOME/server/default/deploy/jmx-console.war/WEB-INF/web.xml -->
<security-constraint>
<web-resource-collection>
<web-resource-name>HtmlAdaptor</web-resource-name>
<url-pattern>/*</url-pattern>
<!-- Remove or comment out specific http-method blocks to secure all methods -->
<!-- <http-method>GET</http-method> -->
<!-- <http-method>POST</http-method> -->
</web-resource-collection>
<auth-constraint>
<role-name>JBossAdmin</role-name>
</auth-constraint>
</security-constraint>3. Log Audit & IoC Verification Commands
Inspect access logs for anomalous HTTP methods targeting the JMX-Console directory.
# Scan access logs for HEAD requests targeting the JMX-Console
grep -i 'HEAD /jmx-console' /var/log/jbossas/access_log*
# Verify if the vulnerable web.xml configuration is present
grep -A 5 '<web-resource-collection>' /usr/share/jbossas/server/default/deploy/jmx-console.war/WEB-INF/web.xmlBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
The vulnerability exists within the security configuration of the JMX-Console web application in JBoss Application Server (JBoss AS). The default web.xml deployment descriptor defines security constraints that explicitly restrict only GET and POST methods. Because of this explicit definition, the servlet container does not apply authentication filters to other HTTP verbs (such as HEAD, PUT, or OPTIONS), leaving the underlying handlers exposed to unauthenticated requests.
2. Exploitation Mechanics & Attack Scenario
An attacker sends an HTTP request to the JMX-Console (/jmx-console/) using the HEAD method instead of GET or POST. Since the security constraint in web.xml only covers GET and POST, the container bypasses the authentication challenge and passes the request to the GET handler. The handler executes the requested administrative action (such as invoking MBeans or deploying a malicious WAR file) and returns only the headers to the attacker. This allows full administrative control without credentials.
3. Infrastructure & Business Impact
As a CISA KEV-listed vulnerability, this flaw has been actively exploited in the wild to compromise enterprise servers. Successful exploitation typically leads to arbitrary code execution via malicious WAR deployment, resulting in complete system compromise, lateral movement within the internal network, and potential ransomware deployment.
Official Vendor Advisories & References
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
Frequently Asked SecOps Questions (CVE-2010-0738)
FAQQ1. How critical is CVE-2010-0738 and is it actively exploited in the wild?
CVE-2010-0738 is rated CVSS 5.3 (MEDIUM) with a 30-day EPSS exploitation probability of 73.8%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2010-0738?
Primary impacted vendors include redhat across jboss_enterprise_application_platform, jboss_as. Scope summary: Red Hat JBoss EAP versions prior to 4.2.0.CP09 and 4.3.0.CP08 with JMX-Console enabled
Q3. What temporary mitigations or workarounds exist for CVE-2010-0738 before patching?
[Mitigation] Apply the official Cumulative Patch (CP), or modify the web.xml configuration to enforce authentication across all HTTP methods. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2010-0738
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (redhat)
View Category →GNOME json-glib Infinite Loop Denial of Service Vulnerability (CVE-2026-120194) Technical Advisory
[Affected Scope] Applications and systems utilizing the GNOME json-glib library to evaluate user-controlled JSONPath queries via json_path_query()
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.