CVE-2007-1036

The default configuration of JBoss does not restrict access to the (1) console and (2) web management interfaces, which allows remote attackers to bypass authentication and gain administrative access via direct requests.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

81.77% chance of exploitation in the next 30 days, 100th percentile

Published

2007-02-21

Updated

2024-08-07

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jboss_maindeployer.rb

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/21080
• https://www.exploit-db.com/exploits/16318

References

• CVE Record
• NVD entry

Related

• CVE-2007-1034
• CVE-2007-1037
• CVE-2007-1031
• CVE-2007-1040
• CVE-2007-1029
• CVE-2007-1041