Descripción
Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information.
Acción recomendada
Aplicar las actualizaciones según las instrucciones del fabricante.
Referencias
- Ficha en NVD (NIST) nvd.nist.gov/vuln/detail/CVE-2010-1428
Otras vulnerabilidades de Red Hat en el catálogo
- CVE-2015-5287 Vulnerabilidad de escalamiento de privilegios en Red Hat Automatic Bug Reporting Tool Alta 26-08-2026
- CVE-2015-3246 Vulnerabilidad de condición de carrera en Red Hat Libuser Alta 26-08-2026
- CVE-2018-14667 Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability Alta 28-09-2023
- CVE-2021-3560 Red Hat Polkit Incorrect Authorization Vulnerability Alta 12-05-2023
- CVE-2021-4034 Red Hat Polkit Out-of-Bounds Read and Write Vulnerability Alta 27-06-2022