Skip to content
Fencer Vulns
medium 5.0

CVE-2008-3273 json

JBoss Enterprise Application Platform (aka JBossEAP or EAP) before 4.2.0.CP03, and 4.3.0 before 4.3.0.CP01, allows remote attackers to obta…

published 2008-08-10 18 y ago modified 2026-06-16 4 mo ago also EUVD-2008-3261

cvss
5.0
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
47.1%
EPSS 47.1% chance of exploitation in 30 days, percentile 98%
public exploits
2
Metasploit

Summary

JBoss Enterprise Application Platform (aka JBossEAP or EAP) before 4.2.0.CP03, and 4.3.0 before 4.3.0.CP01, allows remote attackers to obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string.

Patch / fix

  • bsf jboss enterprise web platform 5 2.4.0-2.2.2.jdk6.ep5.el5
  • bsh jboss enterprise web platform 5 1.3.0-13.2.2.jdk6.ep5.el5
  • msv jboss enterprise web platform 5 1.2-0.20050722.6.jdk6.ep5.el5
  • rhq jboss enterprise web platform 5 3.0.0-9.EmbJopr2.1.jdk6.ep5.el5
  • xom jboss enterprise web platform 5 1.0-4.1.jdk6.ep5.el5
  • bcel jboss enterprise web platform 5 5.1-16.2.1.2.jdk6.ep5.el5
  • ecj3 jboss enterprise web platform 5 1:3.3.1.1-3.1.1.1.jdk6.ep5.el5
  • jdom jboss enterprise web platform 5 1.0-4.4.jdk6.ep5.el5

red hat advisories RHBA-2010:0735RHSA-2008:0828RHSA-2008:0827RHSA-2008:0826RHSA-2008:0825

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2008-3273 updated cvss 5.0

JBossEAP status servlet info leak

  • Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 AS jboss-seam 1.2.1-1.ep1.7.el4, jcommon 1.0.12-1jpp.ep1.3.el4, jfreechart 1.0.9-1jpp.ep1.3.el4, jbossas 4.2.0-3.GA_CP03.ep1.9.el4, jboss-cache 1.4.1-4.SP9.1jpp.ep1.1.el4, glassfish-javamail 1.4.0-0jpp.ep1.9.el4, +7 more Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ES jboss-seam 1.2.1-1.ep1.7.el4, jcommon 1.0.12-1jpp.ep1.3.el4, jfreechart 1.0.9-1jpp.ep1.3.el4, jbossas 4.2.0-3.GA_CP03.ep1.9.el4, jboss-cache 1.4.1-4.SP9.1jpp.ep1.1.el4, glassfish-javamail 1.4.0-0jpp.ep1.9.el4, +7 more
    fixed: vendor fix RHSA-2008:0825
  • Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 Server jboss-seam 1.2.1-1.ep1.6.el5, jcommon 1.0.12-1jpp.ep1.3.el5, jfreechart 1.0.9-1jpp.ep1.3.el5.1, jbossas 4.2.0-4.GA_CP03.ep1.8.el5.1, jboss-cache 1.4.1-4.SP9.1jpp.ep1.1.el5, jbossts 4.2.3-1.SP5_CP01.1jpp.ep1.1.el5, +6 more
    fixed: vendor fix RHSA-2008:0827
  • Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS jcommon 1.0.12-1jpp.ep1.3.el4, jfreechart 1.0.9-1jpp.ep1.3.el4, jbossas 4.3.0-2.GA_CP01.ep1.7.el4, jboss-aop 1.5.5-1.CP01.0jpp.ep1.1.el4, jboss-cache 1.4.1-4.SP9.1jpp.ep1.1.el4, jgroups 2.4.2-1.GA_CP01.0jpp.ep1.1.el4, +11 more Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES jcommon 1.0.12-1jpp.ep1.3.el4, jfreechart 1.0.9-1jpp.ep1.3.el4, jbossas 4.3.0-2.GA_CP01.ep1.7.el4, jboss-aop 1.5.5-1.CP01.0jpp.ep1.1.el4, jboss-cache 1.4.1-4.SP9.1jpp.ep1.1.el4, jgroups 2.4.2-1.GA_CP01.0jpp.ep1.1.el4, +11 more
    fixed: vendor fix RHSA-2008:0826
  • Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server asm 1.5.3-1jpp.ep1.2.el5, cglib 2.1.3-2jpp.ep1.6.el5, jcommon 1.0.12-1jpp.ep1.3.el5, concurrent 1.3.4-8jpp.ep1.6.el5.1, jfreechart 1.0.9-1jpp.ep1.3.el5.1, glassfish-jsf 1.2_08-0jpp.ep1.2.el5, +16 more
    fixed: vendor fix RHSA-2008:0828
  • Red Hat JBoss Web Platform 5 for RHEL 5 Server xom 1.0-4.1.jdk6.ep5.el5, jdom 1.0-4.4.jdk6.ep5.el5, jyaml 1.3-3.1.jdk6.ep5.el5, stax-ex 1.2-8.jdk6.ep5.el5, wss4j 1.5.8-5.jdk6.ep5.el5, javacc 4.0-6.1.jdk6.ep5.el5, +287 more
    fixed: vendor fix RHBA-2010:0735
  • Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 AS asm 1.5.3-1jpp.ep1.2.el4, cglib 2.1.3-2jpp.ep1.6.el4, glassfish-jaf 1.1.0-0jpp.ep1.11.el4, glassfish-jsf 1.2_08-0jpp.ep1.1.el4, jbossws-jboss42 1.2.1-0jpp.ep1.4.el4, jgroups 2.4.2-1.GA_CP01.0jpp.ep1.1.el4, +2 more Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ES asm 1.5.3-1jpp.ep1.2.el4, cglib 2.1.3-2jpp.ep1.6.el4, glassfish-jaf 1.1.0-0jpp.ep1.11.el4, glassfish-jsf 1.2_08-0jpp.ep1.1.el4, jbossws-jboss42 1.2.1-0jpp.ep1.4.el4, jgroups 2.4.2-1.GA_CP01.0jpp.ep1.1.el4, +2 more Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 Server asm 1.5.3-1jpp.ep1.2.el5, cglib 2.1.3-2jpp.ep1.6.el5, glassfish-jsf 1.2_08-0jpp.ep1.2.el5, glassfish-jaf 1.1.0-0jpp.ep1.11.el5.1, jbossws-jboss42 1.2.1-0jpp.ep1.4.el5.1, jgroups 2.4.2-1.GA_CP01.0jpp.ep1.1.el5, +3 more Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS asm 1.5.3-1jpp.ep1.2.el4, cglib 2.1.3-2jpp.ep1.6.el4, concurrent 1.3.4-7jpp.ep1.6.el4, jbossxb 1.0.0-2.SP1.0jpp.ep1.2.el4, glassfish-jaf 1.1.0-0jpp.ep1.11.el4, glassfish-jsf 1.2_08-0jpp.ep1.1.el4, +2 more Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES asm 1.5.3-1jpp.ep1.2.el4, cglib 2.1.3-2jpp.ep1.6.el4, concurrent 1.3.4-7jpp.ep1.6.el4, jbossxb 1.0.0-2.SP1.0jpp.ep1.2.el4, glassfish-jaf 1.1.0-0jpp.ep1.11.el4, glassfish-jsf 1.2_08-0jpp.ep1.1.el4, +2 more Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server glassfish-jaf 1.1.0-0jpp.ep1.11.el5.1, glassfish-javamail 1.4.0-0jpp.ep1.9.el5
    +2 more products
    Red Hat JBoss Web Platform 5 for RHEL 4 AS xom 1.0-4.1.jdk6.ep5.el4, jdom 1.0-4.4.jdk6.ep5.el4, stax-ex 1.2-8.jdk6.ep5.el4, wss4j 1.5.8-5.jdk6.ep5.el4, wstx 3.2.9-1.2.jdk6.ep5.el4, bcel 5.1-16.2.1.jdk6.ep5.el4, +286 more Red Hat JBoss Web Platform 5 for RHEL 4 ES xom 1.0-4.1.jdk6.ep5.el4, jdom 1.0-4.4.jdk6.ep5.el4, stax-ex 1.2-8.jdk6.ep5.el4, wss4j 1.5.8-5.jdk6.ep5.el4, wstx 3.2.9-1.2.jdk6.ep5.el4, bcel 5.1-16.2.1.jdk6.ep5.el4, +286 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

47.11% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.