CVE-2010-0738

Red Hat JBoss Enterprise Application Platform's JMX-Console web application enforces its access-control checks only for the HTTP GET and POST methods, leaving requests sent with other HTTP verbs unauthenticated. A remote attacker can reach the console's GET handler by submitting the same request with a different method (e.g., HEAD), bypassing the configured authentication and access controls entirely. Once past the access control, the attacker can interact with the JMX console's management interfaces, a foothold that on many deployments can be escalated toward broader compromise of the JBoss server. Any organization running Red Hat JBoss (JBoss AS / JBoss EAP) where the JMX-Console is reachable, whether internally or exposed to the internet, is affected. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-05-25) with known ransomware use, and EPSS assigns a 79.4% probability of exploitation within 30 days, so active exploitation should be assumed.

What to do: Apply updates per Red Hat's vendor instructions, as required by CISA's KEV catalog. Until patched, restrict network access to the JMX-Console and block HTTP methods other than GET and POST (e.g., at a reverse proxy or in the application's security constraints) so the access-control check cannot be bypassed with verbs like HEAD, and review logs for requests to /jmx-console using unusual methods. Treat this flaw as actively exploited given its KEV listing with known ransomware use.