Vulnerability record · CVE-2008-3273 · published 10 August 2008
CVE-2008-3273: JBoss EAP status servlet exposes deployed web context information
Jboss · Enterprise Application Platform
JBoss Enterprise Application Platform before 4.2.0.CP03 and 4.3.0 before 4.3.0.CP01 allows remote attackers to obtain sensitive information about deployed web contexts through the status servlet, as demonstrated by a full=true query string. The flaw is an access control weakness (CWE-264) that leaks deployment details useful for reconnaissance.
Description
JBoss Enterprise Application Platform (aka JBossEAP or EAP) before 4.2.0.CP03, and 4.3.0 before 4.3.0.CP01, allows remote attackers to obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string.
AV:N/AC:L/Au:N/C:P/I:N/A:N
Automated analysis
medium priorityThe flaw is an unauthenticated information disclosure with limited direct impact, but the high EPSS score and ease of remote access warrant timely remediation.
What it is
JBoss Enterprise Application Platform before 4.2.0.CP03 and 4.3.0 before 4.3.0.CP01 allows remote attackers to obtain sensitive information about deployed web contexts through the status servlet, as demonstrated by a full=true query string. The flaw is an access control weakness (CWE-264) that leaks deployment details useful for reconnaissance.
Impact
An unauthenticated remote attacker gains information about deployed web contexts, which can reveal application names, paths, and deployment structure. This does not directly grant code execution or data modification, but it materially aids follow-on attacks.
Attack surface
Reachable over the network via HTTP requests to the status servlet; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV and no reference tags indicate public exploit code, but EPSS is 0.47111 (98.78th percentile), indicating a high modeled likelihood of exploitation activity.
What to do
- Apply the vendor fixes referenced in RHSA-2008-0825, RHSA-2008-0826, RHSA-2008-0827, and RHSA-2008-0828, upgrading to JBoss EAP 4.2.0.CP03 or 4.3.0.CP01 or later.
- Restrict network access to the status servlet and management interfaces to trusted administrative networks.
- Disable or remove the status servlet if it is not operationally required.
- Review deployed web contexts and remove or rename any that reveal sensitive internal naming.
Detection
- Monitor HTTP access logs for requests to the status servlet containing full=true or similar parameters.
- Alert on status servlet requests originating from untrusted or external source IP addresses.
- Baseline normal status servlet usage and flag deviations in request volume or source.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2008-3273 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2008-3273), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
