CVE-2010-1428 Known ransomware use

Red Hat JBoss Information Disclosure Vulnerability

Red Hat — JBoss

Added to KEV catalog: 25 May 2022
Federal remediation due date: 15 June 2022
Weakness classification (CWE): CWE-264

CISA Description

Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2010-1428

View on NVD View on MITRE CVE View full CISA catalog

More Red Hat Vulnerabilities

CVE-2015-5287

Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability

CVE-2015-3246

Red Hat Libuser Race Condition Vulnerability

CVE-2018-14667

Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability

CVE-2021-3560

Red Hat Polkit Incorrect Authorization Vulnerability

CVE-2021-4034

Red Hat Polkit Out-of-Bounds Read and Write Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services