Description
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 4 | hibernate3 +1 | 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el4 | RHSA-2010:0379, RHSA-2010:0378, RHSA-2010:0377 |
| Red Hat JBoss EAP 4 | hibernate3-annotations +1 | 3.3.1-1.12.GA_CP03.ep1.el4 | RHSA-2010:0379, RHSA-2010:0378, RHSA-2010:0377 |
| Red Hat JBoss EAP 4 | hsqldb | 1:1.8.0.8-3.patch03.1jpp.ep1.3.el4 | RHSA-2010:0377, RHSA-2010:0376 |
| Red Hat JBoss EAP 4 | jacorb | 2.3.0-1jpp.ep1.10.el4 | RHSA-2010:0379, RHSA-2010:0378, RHSA-2010:0377 |
| Red Hat JBoss EAP 4 | jakarta-commons-httpclient | 1:3.0.1-1.patch01.1jpp.ep1.4.el4 | RHSA-2010:0377, RHSA-2010:0376 |
| Red Hat JBoss EAP 4 | jboss-aop | 1.5.5-3.CP05.2.ep1.el4 | RHSA-2010:0379, RHSA-2010:0378, RHSA-2010:0377 |
| Red Hat JBoss EAP 4 | jboss-cache | 1.4.1-6.SP14.1.ep1.el4 | RHSA-2010:0379, RHSA-2010:0378, RHSA-2010:0377 |
| Red Hat JBoss EAP 4 | jboss-messaging | 1.4.0-3.SP3_CP10.2.ep1.el4 | RHSA-2010:0379, RHSA-2010:0377 |
| Red Hat JBoss EAP 4 | jboss-remoting | 2.2.3-3.SP2.ep1.el4 | RHSA-2010:0379, RHSA-2010:0378, RHSA-2010:0377 |
| Red Hat JBoss EAP 4 | jboss-seam +1 | 1.2.1-1.ep1.24.el4 | RHSA-2010:0379, RHSA-2010:0378, RHSA-2010:0377 |
| Red Hat JBoss EAP 4 | jboss-seam2 +1 | 2.0.2.FP-1.ep1.23.el4 | RHSA-2010:0379, RHSA-2010:0377 |
| Red Hat JBoss EAP 4 | jbossas +2 | 4.2.0-6.GA_CP09.6.ep1.el4 | RHSA-2010:0379, RHSA-2010:0378, RHSA-2010:0377 |
| Red Hat JBoss EAP 4 | jbossas-4.3.0.GA_CP08-bin | 4.3.0-7.GA_CP08.5.ep1.el4 | RHSA-2010:0379, RHSA-2010:0377 |
| Red Hat JBoss EAP 4 | jbossts | 1:4.2.3-1.SP5_CP09.1jpp.ep1.1.el4 | RHSA-2010:0379, RHSA-2010:0378, RHSA-2010:0377 |
| Red Hat JBoss EAP 4 | jbossweb | 2.0.0-6.CP13.0jpp.ep1.1.el4 | RHSA-2010:0379, RHSA-2010:0378, RHSA-2010:0377 |
| Red Hat JBoss EAP 4 | jbossws | 2.0.1-5.SP2_CP08.1.ep1.el4 | RHSA-2010:0379, RHSA-2010:0377 |
| Red Hat JBoss EAP 4 | rh-eap-docs +1 | 4.2.0-7.GA_CP09.ep1.4.1.el5 | RHSA-2010:0379, RHSA-2010:0378, RHSA-2010:0377 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 7 modules
-
JBoss JMX Console Beanshell Deployer WAR Upload and Deployment
exploit/multi/http/jboss_bshdeployer
-
JBoss Vulnerability Scanner
auxiliary/scanner/http/jboss_vulnscan
-
SAP URL Scanner
auxiliary/scanner/sap/sap_icm_urlscan
-
JBoss JMX Console Deployer Upload and Execute
exploit/multi/http/jboss_maindeployer
-
JBoss JMX Console Beanshell Deployer WAR Upload and Deployment
auxiliary/admin/http/jboss_bshdeployer
-
JBoss Java Class DeploymentFileRepository WAR Deployment
exploit/multi/http/jboss_deploymentfilerepository
-
JBoss JMX Console DeploymentFileRepository WAR Upload and Deployment
auxiliary/admin/http/jboss_deploymentfilerepository
Exploit-DB 4
- JBoss & JMX Console - Misconfigured Deployment Scanner EDB-17924 · webapps · Oct 3, 2011
- JBoss Application Server 4.2 < 4.2.0.CP09 / 4.3 < 4.3.0.CP08 - Remote Command Execution EDB-16274 · webapps · Mar 4, 2011 · verified
- JBoss JMX - Console Beanshell Deployer WAR Upload and Deployment (Metasploit) EDB-16319 · remote · Jan 10, 2011 · verified
- JBoss - Java Class DeploymentFileRepository WAR Deployment (Metasploit) EDB-16316 · remote · Aug 3, 2010 · verified
GitHub 2 repositories
-
gitcollect/jboss-autopwn ★ 1 · Jul 2, 2016
JBoss Autopwn CVE-2010-0738 JBoss authentication bypass
-
1872892142/jboss-autopwn-1 ★ 0 · Mar 8, 2016
JBoss Autopwn as featured at BlackHat Europe 2010 - this version incorporates CVE-2010-0738 the JBoss authentication bypass VERB manipulation vulnerability as discovered by Minded Security
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- JBoss JMX/Web Console - Authentication Bypass via HTTP Verb Tampering http/cves/2010/CVE-2010-0738.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 4
- RHSA-2010:0377 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0.CP08 update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- RHSA-2010:0378 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0.CP09 update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- RHSA-2010:0379 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0.CP08 update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- RHSA-2010:0376 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0.CP09 update Red Hat Security Advisories (RHSA) · Jan 8, 2026
References
- RHSA-2010:0379 vendor-advisory
- RHSA-2010:0378 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=574105
- RHSA-2010:0376 vendor-advisory
- 8408 third-party-advisory
- RHSA-2010:0377 vendor-advisory
- http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=35
- ADV-2010-0992 vdb-entry
- HPSBMU02714 vendor-advisory
- jboss-jmxconsole-security-bypass(58147) vdb-entry
- 39710 vdb-entry
- 39563 third-party-advisory
- 1023918 vdb-entry