CVE-2010-0738 kev+ ransomware in the critical feed json
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09…
published 16y ago modified last mo. also EUVD-2010-0764
- cvss
- 3.7
- version 3.1, CNA
- cisa kev
- Exploited
- added 2022-05-25, used in ransomware
- epss
- 73.8%
- EPSS 73.8% chance of exploitation in 30 days, percentile 99.4%
- public exploits
- 11
- Metasploit and Exploit-DB, plus a Nuclei check
Summary
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
Patch / fix
cisa required action Apply updates per vendor instructions.
- jacorb jboss enterprise application platform 4.3.0, jboss enterprise application platform 4.2.0 2.3.0-1jpp.ep1.10.1.el5
- jbossas jboss enterprise application platform 4.3.0 4.3.0-7.GA_CP08.5.ep1.el5
- jbossts jboss enterprise application platform 4.3.0, jboss enterprise application platform 4.2.0 1:4.2.3-1.SP5_CP09.1jpp.ep1.1.1.el5
- jbossws jboss enterprise application platform 4.3.0 2.0.1-5.SP2_CP08.1.ep1.1.el5
- jbossweb jboss enterprise application platform 4.3.0, jboss enterprise application platform 4.2.0 2.0.0-6.CP13.0jpp.ep1.1.1.el5
- jboss-aop jboss enterprise application platform 4.3.0, jboss enterprise application platform 4.2.0 1.5.5-3.CP05.2.ep1.1.el5
- hibernate3 jboss enterprise application platform 4.3.0, jboss enterprise application platform 4.2.0 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el5
- jboss-seam jboss enterprise application platform 4.3.0 1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el5.1
red hat advisories RHSA-2010:0379RHSA-2010:0378RHSA-2010:0377RHSA-2010:0376
Is CVE-2010-0738 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2010-0738 updated cvss 7.5
JBoss EAP jmx authentication bypass with crafted HTTP request
-
Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 AS jacorb 2.3.0-1jpp.ep1.10.el4, jboss-seam 1.2.1-1.ep1.24.el4, jboss-aop 1.5.5-3.CP05.2.ep1.el4, jbossas 4.2.0-6.GA_CP09.6.ep1.el4, jboss-cache 1.4.1-6.SP14.1.ep1.el4, jboss-remoting 2.2.3-3.SP2.ep1.el4, +11 more Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ES jacorb 2.3.0-1jpp.ep1.10.el4, jboss-seam 1.2.1-1.ep1.24.el4, jboss-aop 1.5.5-3.CP05.2.ep1.el4, jbossas 4.2.0-6.GA_CP09.6.ep1.el4, jboss-cache 1.4.1-6.SP14.1.ep1.el4, jboss-remoting 2.2.3-3.SP2.ep1.el4, +11 morefixed: vendor fix RHSA-2010:0376
-
Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 Server jboss-seam 1.2.1-1.ep1.24.el5, jacorb 2.3.0-1jpp.ep1.10.1.el5, jbossas 4.2.0-6.GA_CP09.6.ep1.el5, jboss-aop 1.5.5-3.CP05.2.ep1.1.el5, jboss-cache 1.4.1-6.SP14.1.ep1.1.el5, jboss-remoting 2.2.3-3.SP2.ep1.1.el5, +9 morefixed: vendor fix RHSA-2010:0378
-
Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS jacorb 2.3.0-1jpp.ep1.10.el4, jboss-aop 1.5.5-3.CP05.2.ep1.el4, jboss-seam2 2.0.2.FP-1.ep1.23.el4, jbossas 4.3.0-7.GA_CP08.5.ep1.el4, jboss-cache 1.4.1-6.SP14.1.ep1.el4, jboss-remoting 2.2.3-3.SP2.ep1.el4, +14 more Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES jacorb 2.3.0-1jpp.ep1.10.el4, jboss-aop 1.5.5-3.CP05.2.ep1.el4, jboss-seam2 2.0.2.FP-1.ep1.23.el4, jbossas 4.3.0-7.GA_CP08.5.ep1.el4, jboss-cache 1.4.1-6.SP14.1.ep1.el4, jboss-remoting 2.2.3-3.SP2.ep1.el4, +14 morefixed: vendor fix RHSA-2010:0377
-
Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server jacorb 2.3.0-1jpp.ep1.10.1.el5, jboss-seam2 2.0.2.FP-1.ep1.23.el5, jbossas 4.3.0-7.GA_CP08.5.ep1.el5, jboss-aop 1.5.5-3.CP05.2.ep1.1.el5, jboss-cache 1.4.1-6.SP14.1.ep1.1.el5, jboss-remoting 2.2.3-3.SP2.ep1.1.el5, +12 morefixed: vendor fix RHSA-2010:0379
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Timeline
- First public exploit (Metasploit exploit/multi/http/jboss_maindeployer)
- Published
- Added to CISA KEV
- CISA patch deadline
- CISA SSVC: exploitation active
Known exploited
- Added
- 4y ago
- Patch by
- 2022-06-15 (4y ago)
- Ransomware
- Known to be used in ransomware campaigns
- Required action
- Apply updates per vendor instructions.
- Vendor, product
- Red Hat, JBoss
- CISA name
- Red Hat JBoss Authentication Bypass Vulnerability
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2mo ago
Exploit prediction
73.82% chance of exploitation in the next 30 days, higher than 99.4% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit exploit/multi/http/jboss_bshdeployer JBoss JMX Console Beanshell Deployer WAR Upload and Deployment metasploit exploit, excellent rank, 2010-04-26
- Metasploit exploit/multi/http/jboss_deploymentfilerepository JBoss Java Class DeploymentFileRepository WAR Deployment metasploit exploit, excellent rank, 2010-04-26
- Metasploit exploit/multi/http/jboss_maindeployer JBoss JMX Console Deployer Upload and Execute metasploit exploit, excellent rank, 2007-02-20
- Metasploit auxiliary/admin/http/jboss_bshdeployer JBoss JMX Console Beanshell Deployer WAR Upload and Deployment metasploit auxiliary, normal rank
- Metasploit auxiliary/admin/http/jboss_deploymentfilerepository JBoss JMX Console DeploymentFileRepository WAR Upload and Deployment metasploit auxiliary, normal rank
- Metasploit auxiliary/scanner/http/jboss_vulnscan JBoss Vulnerability Scanner metasploit auxiliary, normal rank
- Metasploit auxiliary/scanner/sap/sap_icm_urlscan SAP URL Scanner metasploit auxiliary, normal rank
- EDB-17924 JBoss & JMX Console - Misconfigured Deployment Scanner webapps, 2011-10-03
- EDB-16319 JBoss JMX - Console Beanshell Deployer WAR Upload and Deployment (Metasploit) remote, 2011-01-10
- EDB-16316 JBoss - Java Class DeploymentFileRepository WAR Deployment (Metasploit) remote, 2010-08-03
- EDB-16274 JBoss Application Server 4.2 < 4.2.0.CP09 / 4.3 < 4.3.0.CP08 - Remote Command Execution webapps, 2011-03-04
- Nuclei template JBoss JMX/Web Console - Authentication Bypass via HTTP Verb Tampering nuclei detection template
- marc.info http://marc.info/?l=bugtraq&m=132129312609324&w=2 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| CNA | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Classification
- Weakness
-
- CWE-749 Exposed Dangerous Method or Function
References
-
marc.info
/?l=bugtraq&m=132129312609324&w=2
vendor-advisory, exploit, mailing-list
-
rhn.redhat.com
/errata/RHSA-2010-0379.html
vendor-advisory
-
rhn.redhat.com
/errata/RHSA-2010-0378.html
vendor-advisory, broken-link
-
rhn.redhat.com
/errata/RHSA-2010-0376.html
vendor-advisory, broken-link
-
rhn.redhat.com
/errata/RHSA-2010-0377.html
vendor-advisory, broken-link
-
vupen.com
/english/advisories/2010/0992
vdb-entry, broken-link, vendor-advisory
-
secunia.com
/advisories/39563
third-party-advisory, broken-link, vendor-advisory
-
bugzilla.redhat.com
/show_bug.cgi?id=574105
issue-tracking
-
securityreason.com
/securityalert/8408
third-party-advisory, broken-link
-
public.support.unisys.com
/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=35
third-party-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/58147
vdb-entry, third-party-advisory
-
securityfocus.com
/bid/39710
vdb-entry, broken-link, third-party-advisory
-
securitytracker.com
/id?1023918
vdb-entry, broken-link, third-party-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-0738
government-resource, us-government-resource
Sources
- CVE List CVE-2010-0738
- NVD CVE-2010-0738
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.