CVE-2008-3273 – JBossEAP status servlet info leak

https://notcve.org/view.php?id=CVE-2008-3273

JBoss Enterprise Application Platform (aka JBossEAP or EAP) before 4.2.0.CP03, and 4.3.0 before 4.3.0.CP01, allows remote attackers to obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string. JBoss Enterprise Application Platform (también conocido como JBossEAP o EAP) anterior a 4.2.0.CP03 y 4.3.0 anterior a 4.3.0.CP01, permite a atacantes remotos obtener información sensible relacionada con "deployed web contexts" (Contextos web desarrollados) a través de una petición al servlet de estado, como se ha demostrado mediante la cadena de consulta full=true. • http://marc.info/?l=bugtraq&m=132698550418872&w=2 http://rhn.redhat.com/errata/RHSA-2008-0825.html http://rhn.redhat.com/errata/RHSA-2008-0826.html http://rhn.redhat.com/errata/RHSA-2008-0827.html http://rhn.redhat.com/errata/RHSA-2008-0828.html http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.2.0.cp03/html-single/readme/index.html http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.3.0.cp01/html-single/readme http: • CWE-264: Permissions, Privileges, and Access Controls •