JBoss JMX/Web Console - Authentication Bypass via HTTP Verb Tampering
CVE-2010-0738
Early Release
Description
JBoss EAP 4.2 (before 4.2.0.CP09) and 4.3 (before 4.3.0.CP08) only enforce authentication for GET/POST on the JMX and Web consoles because the web.xml security-constraint enumerates only those verbs in <http-method>. Non-standard verbs such as HEAD skip the constraint, granting unauthenticated access to MBean operations (which can lead to remote code execution).
Severity
Critical
CVSS Score
9.8
Affected Product
jboss_enterprise_application_platform
Published Date
October 15, 2026
Template Author
hitesh from securin labs (https://securin.io)
CVE-2010-0738.yaml
9.8Score
CVSS Metrics
CVSS Vector:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2010-0738
CWE ID:
cwe-288
Remediation Steps
Update to version 4.2.0.CP09 or later for 4.2, and 4.3.0.CP08 or later for 4.3, or apply security patches provided by Red Hat.