ZeroDay Findings
Sign inSign up

Findings

CVE-2010-0738

Red Hat JBoss Authentication Bypass Vulnerability

Published Apr 28, 2010 · updated Oct 2, 2026 · redhat jboss enterprise application platform

The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 28, 2010 · Catalog

    Detected

    The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.

  2. May 25, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jun 15, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Oct 2, 2026 · Catalog

    Updated

    The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.

Required action

Apply updates per vendor instructions.

CISA due date Jun 15, 2022

Affected

  • cpe redhat/jboss enterprise application platform4.2.0
  • cpe redhat/jboss enterprise application platform4.3.0
  • vendor Red Hat JBossversion unspecified

Sources

  • CISA KEVCVE-2010-0738

    The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.

    cisa.gov
  • CVE.orgCVE-2010-0738

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2010-0738

    30-day exploitation probability 79.6%

    first.org
  • Exploit Database16274

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database16316

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database17924

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesauxiliary_admin/http/jboss_bshdeployer

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • Metasploit Modulesauxiliary_admin/http/jboss_deploymentfilerepository

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • Metasploit Modulesauxiliary_scanner/http/jboss_vulnscan

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2010-0738

    The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this a

    nvd.nist.gov

References

CVE-2010-0738 · ZeroDay Findings