Back

MEDIUM

JBossEAP status servlet info leak

Published Apr 28, 2010

Description

Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 allows remote attackers to obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string. NOTE: this issue exists because of a CVE-2008-3273 regression.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

References (15)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Apr 28, 2010
Updated Aug 7, 2024
Reserved Apr 15, 2010
NVD
Status Modified
Modified Jun 16, 2026
Red Hat
Severity Low
Public date Apr 26, 2010