Live › vulnerability › CVE-2010-0738
Go to dashboardThe JMX-Console web application in Red Hat JBoss Enterprise Application Platform only enforces access control on GET and POST requests. A remote attacker can reach its GET handler by sending the same request with a different HTTP method and skip the login check.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Red Hat JBoss | vendor | – | – |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
This page as .md · .json · in your agent: get_signal("CVE-2010-0738")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.