CVE-2010-0738 JBoss Enterprise Application Platform
| Affected software | JBoss Enterprise Application Platform |
|---|---|
| Severity | 5.3 Medium CVSS 3.1 3 scores |
| Weakness | Exposed dangerous method or function (CWE-749) |
| Published | 28 Apr 2010 |
| Updated | 2 Oct 2026 |
Description
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
Exploitation status
Exploited
Confirmed real-world exploitation.
Exploitation status
- CISA KEV listed Confirmed exploitation in the wild. Added 2022-05-25 · remediation due 2022-06-15 · ransomware use: known
- VulnCheck KEV listed Exploitation reported in the wild. 12 citations · 1 exploit · earliest 2011-04-19.
- CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: no, technical impact: partial.
- Indexed PoC 10 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit, Nuclei; first seen 2010-08-03.
- EPSS 74% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2010-0738 in VulnCheck (free account), which lists 7 more citations not shown here.
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Reported exploitation | verizon.com | /business/resources/reports/data-breach-investigations-report-2011.pdf | 2011-04-19 |
| Reported exploitation | secureworks.com | /research/threat-group-3390-targets-organizations-for-cyberespionage | 2015-08-05 |
| Reported exploitation | nsarchive.gwu.edu | /sites/default/files/documents/5986978/National-Security-Archive-Department-of-Justice.pdf | 2016-03-25 |
| Reported exploitation | tenable.com | /blog/samsam-ransomware-how-to-identify-and-mitigate-the-risk | 2018-03-28 |
| Reported exploitation | news.sophos.com | /en-us/2018/05/02/shutting-out-samsam-ransomware | 2018-05-02 |
| Exploit reference | VulnCheck XDB 3e490ff2e56c | Exploit type: initial-access | 2023-12-20 |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full HTTP verb tampering, Process
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher found this CVE protected by the HTTP Verb Tampering rule, ARMR Process rule. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: HTTP Verb Tampering rule, ARMR Process rule
jmx-console authenticates only GET and POST, so HEAD reaches HtmlAdaptor MBean operations that write a JSP webshell. An HTTP Verb Tampering rule allowing only GET and POST, not narrowed to exact paths, blocks the bypass, and the Process rule (with /bin/* listed) blocks the webshell's exec.
How to mitigate CVE-2010-0738
Apply the vendor's fix for JBoss Enterprise Application Platform. Until you can, Waratek RASP blocks exploitation with its HTTP verb tampering and process rules. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
5.3 MEDIUM
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
3 metrics
CVSS
5.3 MEDIUM v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 5.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
NVD | Primary | published |
| CVSS 3.1 | 3.7 | LOW | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |
CISA-ADP | Secondary | |
| CVSS 2.0 | 5.0 | none | AV:N/AC:L/Au:N/C:P/I:N/A:N |
NVD | Primary |
Affected software and releases
Products and versions
1 product, 2 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | redhat | jboss enterprise application platform | generic | 4.2.0 · 4.3.0 |
References
| URL | Tags |
|---|---|
| http://marc.info/?l=bugtraq&m=132129312609324&w=2 | Exploit, Mailing List |
| http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=35 | Third Party Advisory |
| http://secunia.com/advisories/39563 | Broken Link, Vendor Advisory |
| http://securityreason.com/securityalert/8408 | Broken Link |
| http://securitytracker.com/id?1023918 | Broken Link, Third Party Advisory, VDB Entry |
| http://www.securityfocus.com/bid/39710 | Broken Link, Third Party Advisory, VDB Entry |
| http://www.vupen.com/english/advisories/2010/0992 | Broken Link, Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=574105 | Issue Tracking |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/58147 | Third Party Advisory, VDB Entry |
| https://rhn.redhat.com/errata/RHSA-2010-0376.html | Broken Link |
Timeline
Timeline
| Published | 2010-04-28 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2011-04-19 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| Added to CISA KEV | 2022-05-25 | Listed in CISA's Known Exploited Vulnerabilities catalog. |
| VulnCheck KEV: latest evidence | 2025-07-14 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| Last VRT activity | 2026-09-29 | Most recent commit touching this CVE's classification, patch or rule file. |
| NVD record modified | 2026-10-02 | NVD's own last-modified date for this record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |