$ cve CVE-2010-1428 JSON

CVE-2010-1428 KEV

7.5

HIGH · CVSS 3.1 · EPSS 62.1% (pctl 99)

Patch first

On CISA KEV — known exploited in the wild, due 2022-06-15.

Description

The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an unspecified request that uses a different method.

Scoring

CVSS	7.5 (HIGH, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS	62.05% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-749
On CISA KEV	yes — remediate by 2022-06-15
Public exploit	none known
Published	2010-04-28
Last modified	2026-08-14

CISA KEV

Name	Red Hat JBoss Information Disclosure Vulnerability
Added	2022-05-25
Due	2022-06-15
Vendor / product	Red Hat / JBoss
Ransomware use	known

Affected (1)

Vendor	Product
redhat	jboss enterprise application platform

References

→ the Explorer · watch your stack · NVD