Skip to content
COOEY

FAIL › dossier

JBoss

PRODUCT

· dossier confidence 50%

JBoss is a widely used application server that suffered critical authentication bypass vulnerabilities in its management consoles, revealing systemic weaknesses in access control implementations for administrative interfaces.

Failure events
2
Zero-days
0
RCEs
0
On KEV
2
Critical
2
Worst shame
85
PROFILE
CategoryApplication ServerWhat they doJBoss is an open-source application server and middleware platform used for building and deploying enterprise Java applications.
SECURITY POSTURE

JBoss has a history of critical authentication bypass vulnerabilities in its management consoles, indicating systemic weaknesses in access control implementations for administrative interfaces.

Notable failures
  • CVE-2010-0738 JMX-Console auth bypass
  • CVE-2010-1428 Web Console unauthenticated access
Patterns: incomplete access control on management interfaces; vulnerabilities in non-GET/POST HTTP methods
FAILURE HISTORY · 2
DATEEVENTSEVSUMMARY
2022-05-25 CVE-2010-0738 critical Red Hat JBoss JMX-Console allowed remote attackers to bypass authentication by exploiting incomplete access control on non-GET/POST HTTP methods.
2022-05-25 CVE-2010-1428 critical An incomplete block on the JBoss Web Console allowed unauthenticated attackers to access sensitive information via HTTP verbs beyond GET and POST.
Open questions: Current patch status for CVE-2010-0738 and CVE-2010-1428 · Recent security audit results for JBoss
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-09-14 04:50:29.536862+00:00