Live › vulnerability › CVE-2010-1428
Go to dashboardRed Hat JBoss Application Server's web console at /web-console is meant to block unauthenticated access, but the block only covered GET and POST, so other HTTP verbs get through. A remote attacker can read sensitive information from the server without logging in.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Red Hat JBoss | vendor | – | – |
Unknown from the sources.
Apply the vendor updates per Red Hat's instructions; CISA requires updates per vendor instructions.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an unspecified request that uses a different method.
This page as .md · .json · in your agent: get_signal("CVE-2010-1428")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.