CVE-2010-1428

HighCVSS 7.5/10Known exploited (CISA KEV)Last modified Oct 2, 2026

Description

The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an unspecified request that uses a different method.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-749

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=132698550418872&w=2Exploit, Mailing List
http://secunia.com/advisories/39563Broken Link, Vendor Advisory
http://securitytracker.com/id?1023917Broken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/39710Broken Link, Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2010/0992Broken Link, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=585899Issue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/58148Third Party Advisory, VDB Entry
https://rhn.redhat.com/errata/RHSA-2010-0376.htmlBroken Link, Vendor Advisory
https://rhn.redhat.com/errata/RHSA-2010-0377.htmlBroken Link
https://rhn.redhat.com/errata/RHSA-2010-0378.htmlBroken Link
https://rhn.redhat.com/errata/RHSA-2010-0379.htmlVendor Advisory
http://marc.info/?l=bugtraq&m=132698550418872&w=2Exploit, Mailing List
http://secunia.com/advisories/39563Broken Link, Vendor Advisory
http://securitytracker.com/id?1023917Broken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/39710Broken Link, Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2010/0992Broken Link, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=585899Issue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/58148Third Party Advisory, VDB Entry
https://rhn.redhat.com/errata/RHSA-2010-0376.htmlBroken Link, Vendor Advisory
https://rhn.redhat.com/errata/RHSA-2010-0377.htmlBroken Link
https://rhn.redhat.com/errata/RHSA-2010-0378.htmlBroken Link
https://rhn.redhat.com/errata/RHSA-2010-0379.htmlVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-1428Broken Link

Timeline

Published: Apr 28, 2010
Last modified: Oct 2, 2026
Added to CISA KEV: May 25, 2022
NVD status: Analyzed

Related CVEs from 2010

CVE-2010-14295.0Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 allows remote attacke CVE-2010-14317.5SQL injection vulnerability in templates_export.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands vi CVE-2010-14327.5Joomla! Core is prone to an information disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may CVE-2010-14339.8Joomla! Core is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to properly verify user-su CVE-2010-14347.5Joomla! Core is prone to a session fixation vulnerability. An attacker may leverage this issue to hijack an arbitrary session and gain acces CVE-2010-14359.8Joomla! Core is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions CVE-2010-14364.9gfs2 in the Linux kernel 2.6.18, and possibly other versions, does not properly handle when the gfs2_quota struct occupies two separate page CVE-2010-14377.0Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel 2.6.34-rc5 and earlier allows local users CVE-2010-14384.4Web Application Finger Printer (WAFP) 0.01-26c3 uses fixed pathnames under /tmp for temporary files and directories, which (1) allows local CVE-2010-14393.6yum-rhn-plugin in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Enterprise Linux (RHEL) 5 and Fedora uses world-readable pe CVE-2010-14406.8Multiple integer overflows in dvipsk/dospecial.c in dvips in TeX Live 2009 and earlier, and teTeX, allow remote attackers to cause a denial CVE-2010-14417.5Multiple heap-based buffer overflows in VideoLAN VLC media player before 1.0.6 allow remote attackers to cause a denial of service (applicat