Description
The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an unspecified request that uses a different method.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 4 | hibernate3 +1 | 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el4 | RHSA-2010:0379, RHSA-2010:0378, RHSA-2010:0377 |
| Red Hat JBoss EAP 4 | hibernate3-annotations +1 | 3.3.1-1.12.GA_CP03.ep1.el4 | RHSA-2010:0379, RHSA-2010:0378, RHSA-2010:0377 |
| Red Hat JBoss EAP 4 | hsqldb | 1:1.8.0.8-3.patch03.1jpp.ep1.3.el4 | RHSA-2010:0377, RHSA-2010:0376 |
| Red Hat JBoss EAP 4 | jacorb | 2.3.0-1jpp.ep1.10.el4 | RHSA-2010:0379, RHSA-2010:0378, RHSA-2010:0377 |
| Red Hat JBoss EAP 4 | jakarta-commons-httpclient | 1:3.0.1-1.patch01.1jpp.ep1.4.el4 | RHSA-2010:0377, RHSA-2010:0376 |
| Red Hat JBoss EAP 4 | jboss-aop | 1.5.5-3.CP05.2.ep1.el4 | RHSA-2010:0379, RHSA-2010:0378, RHSA-2010:0377 |
| Red Hat JBoss EAP 4 | jboss-cache | 1.4.1-6.SP14.1.ep1.el4 | RHSA-2010:0379, RHSA-2010:0378, RHSA-2010:0377 |
| Red Hat JBoss EAP 4 | jboss-messaging | 1.4.0-3.SP3_CP10.2.ep1.el4 | RHSA-2010:0379, RHSA-2010:0377 |
| Red Hat JBoss EAP 4 | jboss-remoting | 2.2.3-3.SP2.ep1.el4 | RHSA-2010:0379, RHSA-2010:0378, RHSA-2010:0377 |
| Red Hat JBoss EAP 4 | jboss-seam +1 | 1.2.1-1.ep1.24.el4 | RHSA-2010:0379, RHSA-2010:0378, RHSA-2010:0377 |
| Red Hat JBoss EAP 4 | jboss-seam2 +1 | 2.0.2.FP-1.ep1.23.el4 | RHSA-2010:0379, RHSA-2010:0377 |
| Red Hat JBoss EAP 4 | jbossas +2 | 4.2.0-6.GA_CP09.6.ep1.el4 | RHSA-2010:0379, RHSA-2010:0378, RHSA-2010:0377 |
| Red Hat JBoss EAP 4 | jbossas-4.3.0.GA_CP08-bin | 4.3.0-7.GA_CP08.5.ep1.el4 | RHSA-2010:0379, RHSA-2010:0377 |
| Red Hat JBoss EAP 4 | jbossts | 1:4.2.3-1.SP5_CP09.1jpp.ep1.1.el4 | RHSA-2010:0379, RHSA-2010:0378, RHSA-2010:0377 |
| Red Hat JBoss EAP 4 | jbossweb | 2.0.0-6.CP13.0jpp.ep1.1.el4 | RHSA-2010:0379, RHSA-2010:0378, RHSA-2010:0377 |
| Red Hat JBoss EAP 4 | jbossws | 2.0.1-5.SP2_CP08.1.ep1.el4 | RHSA-2010:0379, RHSA-2010:0377 |
| Red Hat JBoss EAP 4 | rh-eap-docs +1 | 4.2.0-7.GA_CP09.ep1.4.1.el5 | RHSA-2010:0379, RHSA-2010:0378, RHSA-2010:0377 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
JBoss Vulnerability Scanner
auxiliary/scanner/http/jboss_vulnscan
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Red Hat JBoss - Web/JMX Console Access http/cves/2010/CVE-2010-1428.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 4
- RHSA-2010:0377 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0.CP08 update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- RHSA-2010:0378 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0.CP09 update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- RHSA-2010:0379 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0.CP08 update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- RHSA-2010:0376 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0.CP09 update Red Hat Security Advisories (RHSA) · Jan 8, 2026
References
- RHSA-2010:0379 vendor-advisory
- RHSA-2010:0378 vendor-advisory
- jboss-webconsole-information-disclosure(58148) vdb-entry
- HPSBMU02736 vendor-advisory
- RHSA-2010:0376 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=585899
- RHSA-2010:0377 vendor-advisory
- ADV-2010-0992 vdb-entry
- 1023917 vdb-entry
- 39710 vdb-entry
- 39563 third-party-advisory