Unscored severity · published Feb 21, 2007
CVE-2007-1036
The default configuration of JBoss does not restrict access to the (1) console and (2) web management interfaces, which allows remote attackers to bypass authentication and gain…
–
CVSS
82.3%
EPSS
No
On KEV
Description
The default configuration of JBoss does not restrict access to the (1) console and (2) web management interfaces, which allows remote attackers to bypass authentication and gain administrative access via direct requests.
Exploitation
Is it being used?
Exploit prediction (EPSS)82.3% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JA
Jboss Application Server · Jboss
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-1036
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-1036
osvdb.org
http://osvdb.org/33744
wiki.jboss.org
http://wiki.jboss.org/wiki/Wiki.jsp?page=SecureJBoss
wiki.jboss.org
http://wiki.jboss.org/wiki/Wiki.jsp?page=SecureTheJmxConsole
US Government Resource
http://www.kb.cert.org/vuls/id/632656
www.securityfocus.com
http://www.securityfocus.com/archive/1/460597/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/archive/1/460605/100/0/threaded
More from Jboss Application Server
–
CVE-2007-1354
The Access Control functionality (JMXOpsAccessControlFilter) in JMX Console in JBoss Application Server 4.0.2 and 4.0.5 before 20070416 uses a member variable to store the roles…
–
CVE-2006-5750
Directory traversal vulnerability in the DeploymentFileRepository class in JBoss Application Server (jbossas) 3.2.4 through 4.0.5 allows remote authenticated users to read or…