JBoss Application Server Web Console Flaw Lets Remote Users Bypass Authentication
|
|
SecurityTracker Alert ID: 1023917 |
|
SecurityTracker URL: http://securitytracker.com/id/1023917
|
|
CVE Reference:
CVE-2010-1428
(Links to External Site)
|
Date: Apr 27 2010
|
Impact:
Disclosure of user information
|
Fix Available: Yes Vendor Confirmed: Yes
|
|
Description:
A vulnerability was reported in JBoss Application Server. A remote user can bypass authentication to obtain restricted data.
A remote user can send a specially crafted request to the web console to bypass authentication and access ostensibly restricted information on the target server.
|
Impact:
A remote user can obtain potentially sensitive information.
|
Solution:
Red Hat has issued fixes for JBoss Enterprise Application Platform.
[Editor's note: It is unclear which version of JBoss Application Server contains the fix.]
|
Vendor URL: jboss.org/ (Links to External Site)
|
Cause:
Authentication error
|
Underlying OS:
Linux (Red Hat Enterprise)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Tue, 27 Apr 2010 05:05:26 +0000
Subject: JBoss
|
CVE-2010-1428 JBoss Application Server Web Console Authentication bypass
|
|
