CVE-2010-0738

MediumCVSS 5.3/10Known exploited (CISA KEV)Last modified Oct 2, 2026

Description

The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-749

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Apr 28, 2010
Last modified
Oct 2, 2026
Added to CISA KEV
May 25, 2022
NVD status
Analyzed

Related CVEs from 2010

CVE-2010-07396.8Integer overflow in the predospecial function in dospecial.c in dvips in (1) TeX Live and (2) teTeX might allow user-assisted remote attackeCVE-2010-07405.0The ssl3_get_record function in ssl/s3_pkt.c in OpenSSL 0.9.8f through 0.9.8m allows remote attackers to cause a denial of service (crash) vCVE-2010-07417.8The virtio_net_bad_features function in hw/virtio-net.c in the virtio-net driver in the Linux kernel before 2.6.26, when used on a guest OS CVE-2010-07427.5The Cryptographic Message Syntax (CMS) implementation in crypto/cms/cms_asn1.c in OpenSSL before 0.9.8o and 1.x before 1.0.0a does not propeCVE-2010-07435.0Multiple format string vulnerabilities in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) 1.0.3, 0.9.5, and earlierCVE-2010-07445.8aMSN (aka Alvaro's Messenger) 0.98.3 and earlier, when SSL is used, does not verify that the server hostname matches a domain name in the suCVE-2010-07455.0Unspecified vulnerability in Dovecot 1.2.x before 1.2.11 allows remote attackers to cause a denial of service (CPU consumption) via long heaCVE-2010-07466.2Directory traversal vulnerability in DeviceKit-disks in DeviceKit, as used in Fedora 11 and 12 and possibly other operating systems, allows CVE-2010-07477.8drbd8 allows local users to bypass intended restrictions for certain actions via netlink packets, similar to CVE-2009-3725.CVE-2010-07489.8Transmission before 1.92 allows an attacker to cause a denial of service (crash) or possibly have other unspecified impact via a large numbeCVE-2010-07495.3Transmission before 1.92 allows attackers to prevent download of a file by corrupted data during the endgame.CVE-2010-07502.1pkexec.c in pkexec in libpolkit in PolicyKit 0.96 allows local users to determine the existence of arbitrary files via the argument.
CVE-2010-0738: Medium severity, CVSS 5.3 | Vulnix