CVE-2008-3273 JBoss Enterprise Application Platform (aka JBossEAP or EAP) before 4.2.0.CP03, and 4.3.0 before 4.3.0.CP01, allows remote attackers to obtain sensitive information about "deployed web contexts" via a....
MediumCVSS 5.0
EPSS 47.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
JBoss Enterprise Application Platform (aka JBossEAP or EAP) before 4.2.0.CP03, and 4.3.0 before 4.3.0.CP01, allows remote attackers to obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jboss enterprise application platform | <= 4.2.0.cp03 | No fix listed |
| jboss enterprise application platform | <= 4.3.0 | No fix listed |
| jboss enterprise application platform | = 4.2.0.cp01 | No fix listed |
| jboss enterprise application platform | = 4.2.0.cp02 | No fix listed |
References
- HPSBMU02736 vendor-advisory
- RHSA-2008:0825 vendor-advisory
- RHSA-2008:0826 vendor-advisory
- RHSA-2008:0827 vendor-advisory
- RHSA-2008:0828 vendor-advisory
- www.redhat.com
- www.redhat.com
- 30540 vdb-entry
- 1020628 vdb-entry
- bugzilla.redhat.com
- jbosseap-statusservlet-info-disclosure(44235) vdb-entry
- jira.jboss.org