CVE-2010-0738
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
The JMX-Console web application in JBoss fails to protect against requests using HTTP methods other than GET and POST, allowing attackers to bypass access controls and reach protected functions.
The JMX-Console application implements access control checks only for GET and POST HTTP methods (CWE-749: Improper Restriction of Rendered UI Layers or Frames). An attacker can bypass these restrictions by sending requests using alternative HTTP methods (e.g., PUT, DELETE, HEAD, OPTIONS) to access the same resources, potentially leading to unauthorized configuration changes or information disclosure.
The full analysis of this CVE is available in Portuguese →