JBoss Enterprise Application Platform (aka JBossEAP or EAP) before 4.2.0.CP03, and 4.3.0…
Priority MEDIUM 53CWE-264Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-264.
Summary
JBoss Enterprise Application Platform (aka JBossEAP or EAP) before 4.2.0.CP03, and 4.3.0 before 4.3.0.CP01, allows remote attackers to obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string.
Why it matters now
EPSS 0.47111 98th percentileScored 2026-11-07
Fix Fixed Red Hat: 4 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jboss:enterprise_application_platform:*:*:*:*:*:*:*:* | up to 4.2.0.cp03; up to 4.3.0 | Vulnerable | JBoss |
| cpe:2.3:a:jboss:enterprise_application_platform:4.2.0.cp01:*:*:*:*:*:*:* | 4.2.0.cp01 | Vulnerable | JBoss |
| cpe:2.3:a:jboss:enterprise_application_platform:4.2.0.cp02:*:*:*:*:*:*:* | 4.2.0.cp02 | Vulnerable | JBoss |
- cpe:2.3:a:jboss:enterprise_application_platform:*:*:*:*:*:*:*:* Versions up to 4.2.0.cp03; up to 4.3.0 Vulnerable ·JBoss
- cpe:2.3:a:jboss:enterprise_application_platform:4.2.0.cp01:*:*:*:*:*:*:* Versions 4.2.0.cp01 Vulnerable ·JBoss
- cpe:2.3:a:jboss:enterprise_application_platform:4.2.0.cp02:*:*:*:*:*:*:* Versions 4.2.0.cp02 Vulnerable ·JBoss
Remediation
Red Hat 4 advisories
- RHSA-2008:0828 Released 2008-08-05 · Red Hat rating ModerateJBoss Enterprise Application Platform 4.3.0CP01 security update
- Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server asm-1.5.3-1jpp.ep1.2.el5, cglib-2.1.3-2jpp.ep1.6.el5, concurrent-1.3.4-8jpp.ep1.6.el5.1 +21
- RHSA-2008:0827 Released 2008-08-05 · Red Hat rating ModerateJBoss Enterprise Application Platform 4.2.0.CP03 security update
- Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 Server hibernate3-1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el5, hibernate3-annotations-3.2.1-1.patch02.1jpp.ep1.3.el5.1, hibernate3-annotations-javadoc-3.2.1-1.patch02.1jpp.ep1.3.el5.1 +11
- RHSA-2008:0826 Released 2008-08-05 · Red Hat rating ModerateJBoss Enterprise Application Platform 4.3.0.CP01 security update
- Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS glassfish-javamail-1.4.0-0jpp.ep1.9.el4, hibernate3-1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el4, hibernate3-annotations-3.2.1-1.patch02.1jpp.ep1.3.el4 +16
- Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES glassfish-javamail-1.4.0-0jpp.ep1.9.el4, hibernate3-1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el4, hibernate3-annotations-3.2.1-1.patch02.1jpp.ep1.3.el4 +16
Show 1 more Red Hat advisories
- RHSA-2008:0825 Released 2008-08-05 · Red Hat rating ModerateJBoss Enterprise Application Platform 4.2.0.CP03 security update
- Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 AS glassfish-javamail-1.4.0-0jpp.ep1.9.el4, hibernate3-1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el4, hibernate3-annotations-3.2.1-1.patch02.1jpp.ep1.3.el4 +12
- Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ES glassfish-javamail-1.4.0-0jpp.ep1.9.el4, hibernate3-1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el4, hibernate3-annotations-3.2.1-1.patch02.1jpp.ep1.3.el4 +12
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 AS | Fixed | RHSA-2008:0825 |
| Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ES | Fixed | RHSA-2008:0825 |
| Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 Server | Fixed | RHSA-2008:0827 |
| Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS | Fixed | RHSA-2008:0826 |
| Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES | Fixed | RHSA-2008:0826 |
| Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server | Fixed | RHSA-2008:0828 |
| Red Hat JBoss Web Platform 5 for RHEL 5 Server | Fixed | — |
Not affected: 8 products
- Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 AS
- Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ES
- Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 Server
- Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS
- Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES
- Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server
- Red Hat JBoss Web Platform 5 for RHEL 4 AS
- Red Hat JBoss Web Platform 5 for RHEL 4 ES
Timeline
- 2026-10-02 Threatist record created from CVE-2008-3273
- 2026-10-03 Alias added: GHSA-54mf-48cv-vq2x
References
Other 4
- http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.2.0.cp03/html-single/readme/index.html
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=457757
- http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.3.0.cp01/html-single/readme/
- https://jira.jboss.org/jira/browse/JBPAPP-544
More JBoss Enterprise Application Platform vulnerabilities
- TI-2016-01921 The HTTPS NIO Connector allows remote attackers to cause a denial of service (thread… CVSS 3.0HIGH 7.5
Sources
- CVE-2008-3273 · CVE Program
- CVE-2008-3273 · NVD
- FIRST EPSS
- GHSA-54mf-48cv-vq2x · GitHub Advisory Database · CC BY 4.0
- CVE-2008-3273 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences