Is CVE-2010-0738 actively exploited?

Yes. CVE-2010-0738 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2010-0738 be exploited remotely?

The attack vector of CVE-2010-0738 has not been classified yet.

What is the CVSS score of CVE-2010-0738?

CVE-2010-0738 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2010-0738

HIGHCISA KEVIN THE WILD

CVE-2010-0738

Published: May 25, 2022

EPSS:90.85%probability of exploitation in 30 daysPercentile:99.6th

Official Description

The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.

NVD Source

CISA KEV Advisory

Red Hat JBoss Authentication Bypass Vulnerability

Added to KEV: 2022-05-25Federal patch deadline: 2022-06-15⚠ USED IN RANSOMWARE CAMPAIGNS

Required Action (CISA)

Apply updates per vendor instructions.

Risk Analysis

The JMX-Console web application in JBossAs (Red Hat JBoss Enterprise Application Platform) has an access control bypass vulnerability. It only enforces access control for GET and POST methods, allowing attackers to bypass restrictions using other HTTP methods. This high-severity flaw has a very high exploitation likelihood (EPSS 0.90851) and is confirmed exploited in the wild (CISA KEV).

This vulnerability is actively exploited in the wild. Remote attackers can send requests to the JMX-Console's GET handler using alternative methods, bypassing intended security controls.

Recommended Action

Organizations using JBossAs should apply all available security updates to address this access control bypass. Implement network-level restrictions to limit access to the JMX-Console to trusted administrators only.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2010-0738 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2010-0738 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.