CVE-2010-1428: JBoss EAP Web Console access control bypass via non-GET/POST methods

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw is remotely exploitable without authentication, is listed in CISA KEV with known ransomware use, and has a very high EPSS score.

What it is

The Web Console in JBoss Enterprise Application Platform enforces access control only for GET and POST requests, so any other HTTP method bypasses the check. An unauthenticated remote attacker can therefore reach console functionality that should be restricted and read sensitive information. The flaw affects JBoss EAP 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08.

Impact

An attacker gains unauthorized read access to sensitive information exposed by the Web Console, without needing credentials. There is no integrity or availability impact per the CVSS vector.

Attack surface

Reachable over the network through the JBoss Web Console HTTP interface; the CVSS vector shows no privileges required and no user interaction. The attacker only needs to send a request using an HTTP method other than GET or POST.

Exploitation

CVE-2010-1428 is listed in CISA KEV with a due date of 2022-06-15 and known ransomware campaign use, and EPSS is 0.62308 (99.14th percentile). A reference is tagged Exploit, indicating public exploit material exists.

What to do

• Apply the Red Hat JBoss EAP updates referenced in RHSA-2010-0376 through RHSA-2010-0379 (4.2.0.CP09 / 4.3.0.CP08 or later).
• If patching is not immediately possible, restrict network access to the JBoss Web Console to trusted management hosts only.
• Disable or remove the Web Console where it is not operationally required.
• Place the console behind a reverse proxy or WAF that rejects unexpected HTTP methods and enforces authentication.
• Review JBoss EAP instances for unsupported versions and plan migration off end-of-life releases.

Detection

• Inspect web server and JBoss access logs for requests to Web Console paths using HTTP methods other than GET and POST (for example PUT, DELETE, OPTIONS, TRACE, HEAD).
• Alert on Web Console access from IP addresses outside the expected management network.
• Monitor for anomalous or repeated requests to console endpoints that return sensitive data without prior authentication.
• Correlate console access events with authentication logs to flag unauthenticated access to restricted resources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.