Description
JBoss Enterprise Application Platform (aka JBossEAP or EAP) before 4.2.0.CP03, and 4.3.0 before 4.3.0.CP01, allows remote attackers to obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Platform 5 | antlr | 2.7.6-6.2.2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | apache-cxf | 2.2.6-1.patch_01.7.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | apache-james | 0.6-5.2.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | avalon-framework | 4.1.5-2.2.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | avalon-logkit | 1.2-4.3.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | bcel | 5.1-16.2.1.2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | bsf | 2.4.0-2.2.2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | bsh | 1.3.0-13.2.2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | cglib | 2.2-5.1.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | codehaus-jackson +6 | 1.3.5-0.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | codehaus-stax11 +1 | 1.1.2-4.2.3.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | concurrent | 1.3.4-10.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | dom4j +1 | 1.6.1-10.4.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | dtdparser | 1.21-6.1.4.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | ecj3 | 1:3.3.1.1-3.1.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | facelets | 1.1.15-0.b1.4.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | glassfish-jaf | 1.1.0-6.2.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | glassfish-javamail | 1.4.2-0.3.2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | glassfish-jaxb | 2.1.12-5.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | glassfish-jaxws | 2.1.7-0.20.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | glassfish-jsf | 1.2_13-3.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | glassfish-jstl | 1.2.0-10.6.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | gnu-getopt | 1.0.13-1.1.2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | gnu-trove | 1.0.2-7.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | hibernate3 +1 | 1:3.3.2-1.1.GA_CP03.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | hibernate3-annotations +1 | 3.4.0-3.1.GA_CP03.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | hibernate3-commons-annotations +1 | 3.1.0-1.7.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | hibernate3-ejb-persistence-3.0-api +1 | 1:1.0.2-3.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | hibernate3-entitymanager +1 | 3.4.0-4.1.GA_CP03.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | hibernate3-search +1 | 3.1.1-2.2.GA_CP03.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | hibernate3-validator +1 | 3.1.0-1.5.2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | hornetq-jopr-plugin | 1.0.0-0.CR2.0.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | hsqldb | 1:1.8.0.8-3.patch03.2.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | i18nlog | 1.0.10-2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | icu4j | 3.4.5-2.3.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | isorelax | 1:0-0.4.release20050331.2.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jacorb-jboss | 2.3.1-8.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jakarta-commons-beanutils | 1.8.0-4.1.2.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jakarta-commons-codec | 1.3-9.2.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jakarta-commons-collections +1 | 3.2-3.5.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jakarta-commons-dbcp +1 | 1.2.1-16.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jakarta-commons-digester | 1.8.1-8.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jakarta-commons-discovery | 1:0.4-6.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jakarta-commons-el | 1.0-19.2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jakarta-commons-httpclient | 1:3.1-1.2.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jakarta-commons-io | 1.4-1.3.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jakarta-commons-lang | 2.4-1.3.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jakarta-commons-logging +1 | 1.1.1-0.4.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jakarta-commons-logging-jboss | 1.1-10.2.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jakarta-commons-parent | 11-2.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jakarta-commons-pool +1 | 1.3-11.2.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jakarta-commons-transaction | 1.1-3.2.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jakarta-oro | 2.0.8-3.3.2.1.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jakarta-slide-webdavclient | 2.1-9.5.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | javacc | 4.0-6.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | javassist | 3.12.0-1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jaxbintros | 1.0.0-1.1.3.2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jaxen | 1.1.2-5.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-aop2 | 2.1.6-1.CP01.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-aspects-common | 1.0.0-0.b1.1.2.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-bootstrap | 1.0.1-2.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-cache-core | 3.2.5-4.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-cache-pojo | 3.0.0-4.5.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-cl | 2.0.9-1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-cluster-ha-client | 1.1.1-1.3.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-cluster-ha-server-api | 1.1.3-1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-cluster-ha-server-cache-jbc | 2.0.3-1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-cluster-ha-server-cache-spi | 2.0.0-2.3.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-common-core | 2.2.16-3.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-common-logging-jdk | 2.1.1-1.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-common-logging-spi +1 | 2.1.1-1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-current-invocation-aspects | 1.0.1-1.5.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-deployers | 2.0.10-1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-eap5-native | 5.1.0-12.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-ejb3-build | 1.0.13-0.2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-ejb3-cache +1 | 1.0.0-3.4.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-ejb3-common +1 | 1.0.2-0.2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-ejb3-context +5 | 0.1.1-0.4.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-ejb3-core | 1.3.6-0.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-ejb3-deployers | 1.1.4-0.3.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-ejb3-endpoint | 0.1.0-2.4.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-ejb3-endpoint-deployer | 0.1.4-1.3.1.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-ejb3-ext-api | 1.0.0-3.5.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-ejb3-interceptors | 1.0.7-0.3.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-ejb3-jpa-int | 1.0.0-1.1.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-ejb3-mc-int | 1.0.2-1.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-ejb3-metadata | 1.0.0-2.4.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-ejb3-metrics-deployer | 1.1.0-0.2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-ejb3-proxy-clustered | 1.0.3-1.1.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-ejb3-proxy-impl | 1.0.6-1.1.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-ejb3-proxy-spi | 1.0.0-1.3.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-ejb3-timerservice-spi | 1.0.0-1.4.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-ejb3-transactions | 1.0.2-1.3.1.2.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-ejb3-vfs +2 | 1.0.0-0.alpha1.0.2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-el | 1.0_02-0.CR5.2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-integration | 5.1.0-2.SP1.4.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-javaee +8 | 5.0.1-2.6.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-jaxr | 2.0.1-6.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-jpa-deployers | 1.0.0-1.3.2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-logbridge | 1.0.0-3.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-logmanager | 1.1.0-2.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-man | 2.1.1-4.SP2.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-mdr | 2.0.2-3.2.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-metadata | 1.0.6-1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-microcontainer2 | 2.0.10-3.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-naming | 5.0.3-2.2.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-parent | 4.0-1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-reflect | 2.0.3-4.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-remoting | 2.5.3-4.SP1.3.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-remoting-aspects | 1.0.3-0.3.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-seam-int | 5.1.0-1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-seam2 +3 | 2.2.2.EAP-14.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-security-negotiation | 2.0.3-2.SP3.2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-security-spi | 1:2.0.4-4.SP4.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-security-xacml | 2.0.4-4.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-serialization | 1.0.4-0.3.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-threads +1 | 1.0.0-2.2.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-transaction-aspects | 1.0.0-1.4.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-vfs2 | 2.2.0-2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-xnio-base | 1.2.1-3.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss-xnio-metadata | 1.0.1-1.3.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jboss5-libs | 5.1.0-1.3.2.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jbossas-web +3 | 5.1.0-52.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jbossas-ws-cxf-ewp | 5.1.0-7.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jbosssx2 | 2.0.4-4.SP4.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jbossts +1 | 1:4.6.1-5.CP07.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jbossweb +3 | 2.1.10-4.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jbossws | 3.1.2-4.SP7.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jbossws-common | 1.1.0-2.SP6.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jbossws-framework | 3.1.2-4.SP8.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jbossws-parent | 1.0.8-1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jbossws-spi | 1.1.2-3.SP4.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jbossxb2 | 2.0.1-5.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jcip-annotations | 1.0-2.2.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jcommon | 1.0.16-1.2.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jdom | 1.0-4.4.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jettison | 1.1-1.4.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jfreechart | 1.0.13-2.3.2.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jgroups | 1:2.6.16-2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | joda-time | 1.5.2-3.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | joesnmp | 0.3.4-3.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jopr-embedded | 1.3.4-16.SP1.5.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jopr-hibernate-plugin | 3.0.0-8.EmbJopr2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jopr-jboss-as-5-plugin | 3.0.0-7.EmbJopr2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jopr-jboss-cache-v3-plugin | 3.0.0-6.EmbJopr2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | juddi | 2.0.1-2.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | jyaml | 1.3-3.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | log4j | 1.2.14-18.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | mockobjects +1 | 0.09-19.1.1.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | mod_cluster +4 | 1.0.4-2.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | mod_cluster-native | 1.0.4-1.jdk6.ep5.el5.1 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | mod_jk +2 | 1.2.30-2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | msv +1 | 1.2-0.20050722.6.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | mx4j | 1:3.0.1-9.3.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | objectweb-asm | 3.1-5.3.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | org-mc4j-ems | 1.2.15.1-2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | quartz | 1.5.2-6.3.patch01.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | regexp | 1.5-1.2.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | relaxngDatatype | 1.0-2.4.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | resteasy +3 | 1.2.1-7.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | rh-ewp-docs +1 | 5.1.0-5.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | rhq +14 | 3.0.0-9.EmbJopr2.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | rhq-jmx-plugin | 3.0.0-12.EmbJopr2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | rhq-platform-plugin | 3.0.0-9.EmbJopr2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | richfaces +6 | 3.3.1-0.25.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | scannotation | 1.0.2-3.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | servletapi4 | 4.0.4-6.2.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | slf4j | 1.5.8-1.2.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | slf4j-jboss-logging | 1.0.2-1.3.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | snmptrapappender | 1.2.8-7.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | spring2 +6 | 2.5.6-8.SEC02.2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | stax-ex | 1.2-8.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | sun-fi | 1.2.7-4.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | sun-sjsxp | 1.0.1-4.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | sun-ws-metadata-2.0-api | 1.0.MR1-7.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | sun-xmlstreambuffer | 0.8-0.2.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | sun-xsom | 20070515-2.2.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | tomcat-native | 1.1.19-4.0.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | velocity | 1.6.3-0.1.1.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | werken-xpath | 0.9.4-0.beta.13.3.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | ws-commons-XmlSchema | 1.4.5-2.3.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | ws-commons-axiom | 1.2.7-2.3.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | ws-commons-neethi | 2.0.4-1.2.2.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | ws-fx-addressing | 1.0-3.2.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | ws-jaxme | 0.5.1-11.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | ws-scout | 1.1.1-3.4.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | wsdl4j16 +1 | 1.6.2-7.4.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | wss4j | 1.5.8-5.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | wstx | 3.2.9-1.2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | xalan-j2 | 2.7.1-3.2.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | xdoclet | 1.2.3-14.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | xerces-j2 +1 | 2.9.1-2.3.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | xjavadoc | 1.1-1.3.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | xml-commons +8 | 1.3.04-7.10.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | xml-im-exporter | 1.1-3.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | xml-security | 1.4.3-4.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | xom | 1.0-4.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | xpp2 | 2.1.10-6.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | xpp3 | 1.1.4-0.4.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss Web Platform 5 | xstream | 1.3.1-1.4.1.jdk6.ep5.el5 | RHBA-2010:0735 |
| Red Hat JBoss EAP 4 | asm | 1.5.3-1jpp.ep1.2.el5 | RHSA-2008:0828 |
| Red Hat JBoss EAP 4 | cglib | 2.1.3-2jpp.ep1.6.el5 | RHSA-2008:0828 |
| Red Hat JBoss EAP 4 | concurrent | 1.3.4-8jpp.ep1.6.el5.1 | RHSA-2008:0828 |
| Red Hat JBoss EAP 4 | glassfish-javamail | 1.4.0-0jpp.ep1.9.el4 | RHSA-2008:0826, RHSA-2008:0825 |
| Red Hat JBoss EAP 4 | glassfish-jsf | 1.2_08-0jpp.ep1.2.el5 | RHSA-2008:0828 |
| Red Hat JBoss EAP 4 | hibernate3 +1 | 1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el4 | RHSA-2008:0828, RHSA-2008:0827, RHSA-2008:0826 |
| Red Hat JBoss EAP 4 | hibernate3-annotations +1 | 3.2.1-1.patch02.1jpp.ep1.3.el4 | RHSA-2008:0828, RHSA-2008:0827, RHSA-2008:0826 |
| Red Hat JBoss EAP 4 | hibernate3-entitymanager +1 | 3.2.1-1jpp.ep1.7.el5 | RHSA-2008:0828 |
| Red Hat JBoss EAP 4 | jboss-aop | 1.5.5-1.CP01.0jpp.ep1.1.el4 | RHSA-2008:0828, RHSA-2008:0826 |
| Red Hat JBoss EAP 4 | jboss-cache | 1.4.1-4.SP9.1jpp.ep1.1.el4 | RHSA-2008:0828, RHSA-2008:0827, RHSA-2008:0826 |
| Red Hat JBoss EAP 4 | jboss-messaging | 1.4.0-1.SP3_CP02.0jpp.ep1.6.el4 | RHSA-2008:0828, RHSA-2008:0826 |
| Red Hat JBoss EAP 4 | jboss-remoting | 2.2.2-3.SP7.0jpp.ep1.3.el4 | RHSA-2008:0828, RHSA-2008:0827, RHSA-2008:0826 |
| Red Hat JBoss EAP 4 | jboss-seam +1 | 1.2.1-1.ep1.6.el5 | RHSA-2008:0828, RHSA-2008:0827, RHSA-2008:0826 |
| Red Hat JBoss EAP 4 | jbossas | 4.2.0-3.GA_CP03.ep1.9.el4 | RHSA-2008:0828, RHSA-2008:0827, RHSA-2008:0826 |
| Red Hat JBoss EAP 4 | jbossts | 1:4.2.3-1.SP5_CP01.1jpp.ep1.1.el4 | RHSA-2008:0828, RHSA-2008:0827, RHSA-2008:0826 |
| Red Hat JBoss EAP 4 | jbossws | 2.0.1-2.SP2_CP01.0jpp.ep1.2.el4 | RHSA-2008:0828, RHSA-2008:0826 |
| Red Hat JBoss EAP 4 | jbossxb | 1.0.0-2.SP1.0jpp.ep1.2.el5.1 | RHSA-2008:0828 |
| Red Hat JBoss EAP 4 | jcommon | 1.0.12-1jpp.ep1.3.el4 | RHSA-2008:0828, RHSA-2008:0827, RHSA-2008:0826 |
| Red Hat JBoss EAP 4 | jfreechart | 1.0.9-1jpp.ep1.3.el4 | RHSA-2008:0828, RHSA-2008:0827, RHSA-2008:0826 |
| Red Hat JBoss EAP 4 | jgroups | 1:2.4.2-1.GA_CP01.0jpp.ep1.1.el4 | RHSA-2008:0828, RHSA-2008:0826 |
| Red Hat JBoss EAP 4 | rh-eap-docs +1 | 4.2.0-3.GA_CP03.ep1.5.el4 | RHSA-2008:0828, RHSA-2008:0827, RHSA-2008:0826 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 2 modules
-
JBoss Status Servlet Information Gathering
auxiliary/scanner/http/jboss_status
-
JBoss Vulnerability Scanner
auxiliary/scanner/http/jboss_vulnscan
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 5
- RHBA-2010:0735 Red Hat Bug Fix Advisory: JBoss Enterprise Web Platform 5.1.0 update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0828 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0CP01 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0827 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0.CP03 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0826 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0.CP01 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0825 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0.CP03 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- RHSA-2008:0828 vendor-advisory
- RHSA-2008:0826 vendor-advisory
- HPSBMU02736 vendor-advisory
- http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.2.0.cp03/html-single/readme/index.html
- jbosseap-statusservlet-info-disclosure(44235) vdb-entry
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=457757
- http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.3.0.cp01/html-single/readme/
- RHSA-2008:0827 vendor-advisory
- https://jira.jboss.org/jira/browse/JBPAPP-544
- RHSA-2008:0825 vendor-advisory
- 1020628 vdb-entry
- 30540 vdb-entry