CVE-2010-1428
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
JBoss Web Console fails to protect sensitive information from requests using HTTP methods other than GET and POST, allowing attackers to bypass security controls and access restricted data.
The Web Console in JBoss EAP 4.2 and 4.3 implements access control only for GET and POST HTTP methods, leaving other methods (e.g., HEAD, OPTIONS, TRACE) unprotected. An unauthenticated remote attacker can exploit this incomplete method validation to retrieve sensitive information by crafting requests with alternative HTTP verbs.
The full analysis of this CVE is available in Portuguese →