CVE-2010-0738
KEV RANSOMWAREMEDIUM 5.3EPSS 74.7%
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
- CVSS v3.1 NVD
- 5.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS v3.1 CNA
- 3.7 LOW
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS v2.0 NVD
- 5.0 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N - EPSS
- 74.72% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2022-05-25, used in ransomware campaigns
- Nuclei
- critical · CWE-288
- Published
- 2010-04-28
- Updated
- 2026-10-01
Nuclei templates (1)
Metasploit modules (6)
- rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jboss_bshdeployer.rb
- rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jboss_deploymentfiler…
- rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jboss_maindeployer.rb
- rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/jboss_bshdeployer.rb
- rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/jboss_deploymentfile…
- rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/sap/sap_icm_urlscan.rb
ExploitDB entries (4)
- https://www.exploit-db.com/exploits/16319
- https://www.exploit-db.com/exploits/16316
- https://www.exploit-db.com/exploits/16274
- https://www.exploit-db.com/exploits/17924
Security advisories
- http://secunia.com/advisories/39563
- http://www.vupen.com/english/advisories/2010/0992
- https://rhn.redhat.com/errata/RHSA-2010-0379.html
- http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=35
- http://securitytracker.com/id?1023918
- http://www.securityfocus.com/bid/39710
- https://exchange.xforce.ibmcloud.com/vulnerabilities/58147
- https://bugzilla.redhat.com/show_bug.cgi?id=574105