CVE-2010-1428

CVE-2010-1428 describes an access control bypass vulnerability in the JBoss Web Console (web-console) within Red Hat JBoss Enterprise Application Platform (EAP) versions 4.2 prior to 4.2.0.CP09 and 4.3 prior to 4.3.0.CP08. This flaw allows remote attackers to obtain sensitive information by using HTTP methods other than GET or POST, which are the only methods subject to access control. With a CVSS score of 7.5 (HIGH), this vulnerability is easily exploitable over the network with no authentication or user interaction required, leading to high confidentiality impact. Notably, this CVE is listed in CISA's KEV catalog, indicating active exploitation, including use in known ransomware campaigns, and a Metasploit module exists for scanning. Despite its severity and active exploitation, there is minimal public discussion or media coverage.