Actively exploited in the wild
Red Hat JBoss Authentication Bypass Vulnerability
Red Hat - JBoss · Listed in the CISA KEV since 2022-05-25. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2010-0738
MediumCVSS 5.3KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (JBoss EAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for GET and POST methods, allowing remote attackers to send requests using other methods.
Risk Assessment
Attackers can bypass access controls and gain unauthorized access to the JMX console, potentially compromising system integrity.
Recommendation
Upgrade JBoss EAP to a patched version (4.2.0.CP09 or later, 4.3.0.CP08 or later). Additionally, restrict network access to the JMX console.
Original NVD description (English source)
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.