Skip to content
Fencer Vulns
medium 4.3

CVE-2008-3519 json

The default configuration of the JBossAs component in Red Hat JBoss Enterprise Application Platform (aka JBossEAP or EAP), possibly 4.2 bef…

published 2008-09-23 18 y ago modified 2026-06-16 4 mo ago also EUVD-2008-3505

cvss
4.3
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.6%
EPSS 1.6% chance of exploitation in 30 days, percentile 76%
public exploits
0
none known

Summary

The default configuration of the JBossAs component in Red Hat JBoss Enterprise Application Platform (aka JBossEAP or EAP), possibly 4.2 before CP04 and 4.3 before CP02, when a production environment is enabled, sets the DownloadServerClasses property to true, which allows remote attackers to obtain sensitive information (non-EJB classes) via a download request, a different vulnerability than CVE-2008-3273.

Patch / fix

  • jbossas jboss enterprise application platform 4.2.0 4.2.0-4.GA_CP04.ep1.7.el5.6
  • jbossts jboss enterprise application platform 4.3.0, jboss enterprise application platform 4.2.0 1:4.2.3-1.SP5_CP02.1jpp.ep1.2.el5
  • jbossweb jboss enterprise application platform 4.3.0, jboss enterprise application platform 4.2.0 2.0.0-4.CP06.0jpp.ep1.1.el5
  • jboss-aop jboss enterprise application platform 4.3.0, jboss enterprise application platform 4.2.0 1.5.5-2.CP02.0jpp.ep1.2.el5
  • hibernate3 jboss enterprise application platform 4.3.0, jboss enterprise application platform 4.2.0 1:3.2.4-1.SP1_CP04.0jpp.ep1.3.el5
  • jboss-seam jboss enterprise application platform 4.2.0 1.2.1-1.ep1.9.el5
  • jboss-remoting jboss enterprise application platform 4.2.0 2.2.2-3.SP9.0jpp.ep1.2.el5
  • hibernate3-javadoc jboss enterprise application platform 4.2.0 1:3.2.4-1.SP1_CP04.0jpp.ep1.3.el5

red hat advisories RHSA-2008:0834RHSA-2008:0833RHSA-2008:0832RHSA-2008:0831

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2008-3519 updated

JBossEAP allows download of non-EJB class files

  • Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 AS jboss-seam 1.2.1-1.ep1.10.el4, jbossas 4.2.0-3.GA_CP04.ep1.8.el4, jbossweb 2.0.0-4.CP06.0jpp.ep1.1.el4, jboss-aop 1.5.5-2.CP02.0jpp.ep1.2.el4, jbossts 4.2.3-1.SP5_CP02.1jpp.ep1.1.el4, glassfish-javamail 1.4.0-0jpp.ep1.10.el4, +7 more Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ES jboss-seam 1.2.1-1.ep1.10.el4, jbossas 4.2.0-3.GA_CP04.ep1.8.el4, jbossweb 2.0.0-4.CP06.0jpp.ep1.1.el4, jboss-aop 1.5.5-2.CP02.0jpp.ep1.2.el4, jbossts 4.2.3-1.SP5_CP02.1jpp.ep1.1.el4, glassfish-javamail 1.4.0-0jpp.ep1.10.el4, +7 more
    fixed: vendor fix RHSA-2008:0833
  • Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 Server jboss-seam 1.2.1-1.ep1.9.el5, jbossas 4.2.0-4.GA_CP04.ep1.7.el5.6, jbossweb 2.0.0-4.CP06.0jpp.ep1.1.el5, jboss-aop 1.5.5-2.CP02.0jpp.ep1.2.el5, jbossts 4.2.3-1.SP5_CP02.1jpp.ep1.2.el5, jboss-remoting 2.2.2-3.SP9.0jpp.ep1.2.el5, +5 more
    fixed: vendor fix RHSA-2008:0834
  • Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS javassist 3.8.0-1.ep1.el4, jbossas 4.3.0-2.GA_CP02.ep1.10.el4, glassfish-jaxb 2.1.4-1jpp.ep1.2.el4, glassfish-jaxws 2.1.1-1jpp.ep1.3.el4, jbossweb 2.0.0-4.CP06.0jpp.ep1.1.el4, jboss-aop 1.5.5-2.CP02.0jpp.ep1.2.el4, +15 more Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES javassist 3.8.0-1.ep1.el4, jbossas 4.3.0-2.GA_CP02.ep1.10.el4, glassfish-jaxb 2.1.4-1jpp.ep1.2.el4, glassfish-jaxws 2.1.1-1jpp.ep1.3.el4, jbossweb 2.0.0-4.CP06.0jpp.ep1.1.el4, jboss-aop 1.5.5-2.CP02.0jpp.ep1.2.el4, +15 more
    fixed: vendor fix RHSA-2008:0831
  • Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server javassist 3.8.0-1jpp.ep1.2.el5, jboss-jaxr 1.2.0-SP1.0jpp.ep1.4.el5, glassfish-jaxws 2.1.1-1jpp.ep1.3.el5, glassfish-jstl 1.2.0-0jpp.ep1.10.el5, jbossas 4.3.0-2.GA_CP02.ep1.10.el5.2, jbossweb 2.0.0-4.CP06.0jpp.ep1.1.el5, +20 more
    fixed: vendor fix RHSA-2008:0832
  • Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 AS javassist 3.8.0-1.ep1.el4, jbossxb 1.0.0-2.SP3.0jpp.ep1.3.el4, glassfish-jaf 1.1.0-0jpp.ep1.12.el4, jboss-jaxr 1.2.0-SP1.0jpp.ep1.4.el4, glassfish-jstl 1.2.0-0jpp.ep1.10.el4, jakarta-commons-beanutils 1.7.0-2jpp.ep1.5.el4, +3 more Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ES javassist 3.8.0-1.ep1.el4, jbossxb 1.0.0-2.SP3.0jpp.ep1.3.el4, glassfish-jaf 1.1.0-0jpp.ep1.12.el4, jboss-jaxr 1.2.0-SP1.0jpp.ep1.4.el4, glassfish-jstl 1.2.0-0jpp.ep1.10.el4, jakarta-commons-beanutils 1.7.0-2jpp.ep1.5.el4, +3 more Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 Server javassist 3.8.0-1jpp.ep1.2.el5, jboss-jaxr 1.2.0-SP1.0jpp.ep1.4.el5, glassfish-jstl 1.2.0-0jpp.ep1.10.el5, jbossxb 1.0.0-2.SP3.0jpp.ep1.3.el5.1, glassfish-jaf 1.1.0-0jpp.ep1.12.el5.1, glassfish-javamail 1.4.0-0jpp.ep1.10.el5, +4 more Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS jbossxb 1.0.0-2.SP3.0jpp.ep1.3.el4, glassfish-jaf 1.1.0-0jpp.ep1.12.el4, jboss-jaxr 1.2.0-SP1.0jpp.ep1.4.el4, glassfish-jstl 1.2.0-0jpp.ep1.10.el4, jakarta-commons-beanutils 1.7.0-2jpp.ep1.5.el4, hibernate3-commons-annotations 0.0.0-1.1jpp.ep1.1.el4, +2 more Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES jbossxb 1.0.0-2.SP3.0jpp.ep1.3.el4, glassfish-jaf 1.1.0-0jpp.ep1.12.el4, jboss-jaxr 1.2.0-SP1.0jpp.ep1.4.el4, glassfish-jstl 1.2.0-0jpp.ep1.10.el4, jakarta-commons-beanutils 1.7.0-2jpp.ep1.5.el4, hibernate3-commons-annotations 0.0.0-1.1jpp.ep1.1.el4, +2 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.62% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.