Red Hat JBoss - Web/JMX Console Access
| Reporter | Title | Published | Views | Family All 40 |
|---|---|---|---|---|
 | JBoss EAP < 4.2.0.CP09 / 4.3.0.CP08 Multiple Vulnerabilities | 29 Apr 201000:00 | – | nessus |
| JBoss Enterprise Application Platform '/web-console' Authentication Bypass | 29 Apr 201000:00 | – | nessus |
| Juniper Junos Space < 13.3R1.8 Multiple Vulnerabilities (JSA10627) | 22 Dec 201400:00 | – | nessus |
| RHEL 4 : JBoss EAP (RHSA-2010:0376) | 24 Jan 201300:00 | – | nessus |
| RHEL 4 : JBoss EAP (RHSA-2010:0377) | 24 Jan 201300:00 | – | nessus |
| RHEL 5 : JBoss EAP (RHSA-2010:0378) | 24 Jan 201300:00 | – | nessus |
| RHEL 5 : JBoss Enterprise Application Platform 4.3.0.CP08 update (Critical) (RHSA-2010:0379) | 24 Jan 201300:00 | – | nessus |
 | CVE-2010-1428 | 28 Apr 201000:00 | – | attackerkb |
 | JBoss Enterprise Application Platform Information Disclosure | 22 Aug 202200:00 | – | bdu_fstec |
 | CVE-2010-1428 | 29 May 201815:50 | – | circl |
10
id: CVE-2010-1428
info:
name: Red Hat JBoss - Web/JMX Console Access
author: Jayachandran from Securin Labs (https://securin.io)
severity: high
description: |
Red Hat JBoss Enterprise Application Platform (EAP) can expose the Web Console, JMX Console, and JMXInvokerServlet without authentication, allowing remote attackers to reach admin dashboards and interact with MBeans, leading to full server compromise.
impact: |
Attackers can retrieve sensitive information by bypassing access controls, leading to information disclosure.
remediation: |
Restrict access to /web-console, /jmx-console and /invoker, and enforce authentication on the JBoss management interfaces.
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2010-1428
- https://access.redhat.com/security/cve/CVE-2010-1428
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 7.5
cve-id: CVE-2010-1428
epss-score: 0.52654
epss-percentile: 0.9896
cwe-id: CWE-306
metadata:
verified: false
max-request: 3
vendor: redhat
product: jboss_enterprise_application_platform
shodan-query:
- http.html:"/jmx-console/"
- http.title:"jboss"
- cpe:"cpe:2.3:a:redhat:jboss_enterprise_application_platform"
fofa-query: 'title="JBoss" && body="/jmx-console/"'
tags: cve,cve2010,jboss,redhat,unauth,exposure,auth-bypass,kev,vkev
http:
- method: GET
path:
- "{{BaseURL}}/jmx-console/"
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
part: body
words:
- "JMX Agent View"
- "jboss.system:type"
- "HtmlAdaptor?action"
condition: or
- method: GET
path:
- "{{BaseURL}}/web-console/"
- "{{BaseURL}}/web-console/ServerInfo.jsp"
stop-at-first-match: true
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
part: body
words:
- "JBoss Management Console"
- "org.jboss.console"
condition: or
- method: GET
path:
- "{{BaseURL}}/invoker/JMXInvokerServlet"
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
part: header
words:
- "application/x-java-serialized-object"
# digest: 4b0a00483046022100ddbdc8bb0172ad8594ec78b76d7430e71900e5bfa786ca0941965ff80be54941022100e71448fb525e2b11c1852a7c4902f8caff83cce9e48330cb140f9ba80f8cdfa0:922c64590222798bb761d5b6d8e72950Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
25 Oct 2026 00:01Current
7High risk
Vulners AI Score7
CVSS 25
CVSS 3.15.9 - 7.5
EPSS0.52654
SSVC