CVE-2010-3878

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Cross-site request forgery (CSRF) vulnerability in the JMX Console in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 allows remote attackers to hijack the authentication of administrators for requests that deploy WAR files.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://securitytracker.com/id?1024813
http://www.redhat.com/support/errata/RHSA-2010-0937.htmlVendor Advisory
http://www.redhat.com/support/errata/RHSA-2010-0938.htmlVendor Advisory
http://www.redhat.com/support/errata/RHSA-2010-0939.htmlVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=604617
http://securitytracker.com/id?1024813
http://www.redhat.com/support/errata/RHSA-2010-0937.htmlVendor Advisory
http://www.redhat.com/support/errata/RHSA-2010-0938.htmlVendor Advisory
http://www.redhat.com/support/errata/RHSA-2010-0939.htmlVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=604617

Timeline

Published: Dec 30, 2010
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2010

CVE-2010-38795.8FUSE, possibly 2.8.5 and earlier, allows local users to create mtab entries with arbitrary pathnames, and consequently unmount any filesyste CVE-2010-38804.9net/ipv4/inet_diag.c in the Linux kernel before 2.6.37-rc2 does not properly audit INET_DIAG bytecode, which allows local users to cause a d CVE-2010-38812.1arch/x86/kvm/x86.c in the Linux kernel before 2.6.36.2 does not initialize certain structure members, which allows local users to obtain pot CVE-2010-38824.3Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.7.1 and earlier allow remote attackers to inject arbitrary web scri CVE-2010-38836.8Cross-site request forgery (CSRF) vulnerability in the Change Group Permissions module in CMS Made Simple 1.7.1 and earlier allows remote at CVE-2010-38846.8Cross-site request forgery (CSRF) vulnerability in CMS Made Simple 1.8.1 and earlier allows remote attackers to hijack the authentication of CVE-2010-38864.3The CTimeoutEventList::InsertIntoTimeoutList function in Microsoft mshtml.dll uses a certain pointer value as part of producing Timer ID val CVE-2010-38874.3The Limit Mail feature in the Parental Controls functionality in Mail on Apple Mac OS X does not properly enforce the correspondence whiteli CVE-2010-38887.2Unspecified vulnerability in Microsoft Windows on 32-bit platforms allows local users to gain privileges via unknown vectors, as exploited i CVE-2010-38897.2Unspecified vulnerability in Microsoft Windows on 32-bit platforms allows local users to gain privileges via unknown vectors, as exploited i CVE-2010-38904.3Cross-site scripting (XSS) vulnerability in IBM OmniFind Enterprise Edition before 9.1 allows remote attackers to inject arbitrary web scrip CVE-2010-38916.8Cross-site request forgery (CSRF) vulnerability in ESAdmin/security.do in the administrator interface in IBM OmniFind Enterprise Edition bef