cve-2010-2493
CRITICAL vulncheck_kev
Description
The default configuration of the deployment descriptor (aka web.xml) in picketlink-sts.war in (1) the security_saml quickstart, (2) the webservice_proxy_security quickstart, (3) the web-console application, (4) the http-invoker application, (5) the gpd-deployer application, (6) the jbpm-console application, (7) the contract application, and (8) the uddi-console application in JBoss Enterprise SOA Platform before 5.0.2 contains GET and POST http-method elements, which allows remote attackers to bypass intended access restrictions via a crafted HTTP request.
Timeline
- Published
- 2016-03-25 00:00 UTC
- Last Modified
- 2016-03-25
CVSS Details
CVSS details not available.
Affected Products
No product information available.
References
No references available.
Linked Vulnerabilities
No linked vulnerabilities found.
{
"cvss": 0.0,
"datePublished": "2016-03-25T00:00:00Z",
"dateUpdated": "2016-03-25T00:00:00Z",
"description": "The default configuration of the deployment descriptor (aka web.xml) in picketlink-sts.war in (1) the security_saml quickstart, (2) the webservice_proxy_security quickstart, (3) the web-console application, (4) the http-invoker application, (5) the gpd-deployer application, (6) the jbpm-console application, (7) the contract application, and (8) the uddi-console application in JBoss Enterprise SOA Platform before 5.0.2 contains GET and POST http-method elements, which allows remote attackers to bypass intended access restrictions via a crafted HTTP request.",
"dueDate": "",
"id": "CVE-2010-2493",
"kev_catalogs": [
"vulncheck"
],
"knownRansomwareCampaignUse": "Known",
"product": "jboss_enterprise_soa_platform",
"requiredAction": "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.",
"severity": "CRITICAL",
"source": "vulncheck_kev",
"title": "JBoss Enterprise SOA Platform before 5.0.2 contains GET and POST http-method Security Bypass",
"vendor": "Red Hat"
}