CVE-2010-1429: JBoss EAP status servlet exposes deployed web context information

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityUnauthenticated remote information disclosure with public exploit code and a very high EPSS score, though impact is limited to reconnaissance.

What it is

JBoss Enterprise Application Platform 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 allows remote attackers to obtain sensitive information about deployed web contexts through a request to the status servlet, for example with a full=true query string. The issue is a regression of CVE-2008-3273, meaning an access control fix was lost in these versions.

Impact

An unauthenticated remote attacker learns which web applications are deployed and related context details, useful for reconnaissance and targeting follow-on attacks. No integrity or availability impact is described.

Attack surface

Reachable over the network via HTTP requests to the JBoss status servlet; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented; EPSS is high (0.53728, 98.9th percentile) and a public Exploit-DB entry exists, indicating exploit code is available.

What to do

• Apply the Red Hat errata fixes (RHSA-2010-0376 through RHSA-2010-0379) to move to JBoss EAP 4.2.0.CP09 or 4.3.0.CP08 and later.
• If patching is delayed, restrict network access to the JBoss status servlet to trusted management hosts.
• Disable or remove the status servlet where it is not operationally required.
• Verify the CVE-2008-3273 access control fix is present after any upgrade, since this is a regression.

Detection

• Search web and proxy logs for requests to the JBoss status servlet, especially with a full=true query string.
• Alert on status servlet requests originating from outside expected management networks.
• Review JBoss deployments for the status servlet being enabled and externally reachable.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.