CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Red Hat JBoss EAP Web Console HTTP Verb Tampering Information Disclosure (CVE-2010-1428)
[Affected Scope] Red Hat JBoss Enterprise Application Platform (JBoss EAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08.
[Impact] Remote attackers can bypass authentication and access sensitive administrative information within the Web Console by utilizing non-standard HTTP methods (such as HEAD or PUT).
[Mitigation] Apply the official Cumulative Patch (CP) or modify the web.xml configuration to enforce authentication across all HTTP methods.
Red Hat JBoss EAP JMX-Console HTTP Verb Tampering Authentication Bypass (CVE-2010-0738)
[Affected Scope] Red Hat JBoss Enterprise Application Platform (JBoss EAP) 4.2 (prior to 4.2.0.CP09) and 4.3 (prior to 4.3.0.CP08).
[Impact] Remote attackers can bypass authentication on the JMX-Console by utilizing non-standard HTTP methods (such as HEAD), allowing unauthorized administrative actions.
[Mitigation] Apply the official Cumulative Patch (CP), or modify the web.xml configuration to enforce authentication across all HTTP methods.