Unscored severity · published Aug 10, 2008
CVE-2008-3273
JBoss Enterprise Application Platform (aka JBossEAP or EAP) before 4.2.0.CP03, and 4.3.0 before 4.3.0.CP01, allows remote attackers to obtain sensitive information about "deployed…
–
CVSS
47.1%
EPSS
No
On KEV
Description
JBoss Enterprise Application Platform (aka JBossEAP or EAP) before 4.2.0.CP03, and 4.3.0 before 4.3.0.CP01, allows remote attackers to obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string.
Exploitation
Is it being used?
Exploit prediction (EPSS)47.1% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EA
Enterprise Application Platform · Jboss
through 4.2.0.cp03; through 4.3.0; 4.2.0.cp01; 4.2.0.cp02 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-3273
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-3273
marc.info
http://marc.info/?l=bugtraq&m=132698550418872&w=2
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2008-0825.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2008-0826.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2008-0827.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2008-0828.html
www.redhat.com
http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.2.0.cp03/html-single/readme/index.html
More from Enterprise Application Platform
7.5
CVE-2016-2094
The HTTPS NIO Connector allows remote attackers to cause a denial of service (thread consumption) by opening a socket and not sending an SSL handshake, aka a read-timeout…