CVE-2008-3273: JBoss Enterprise Application Platform

Medium severity, CVSS 5.0. EPSS: 47.1% chance of exploitation in the next 30 days.

JBoss Enterprise Application Platform (aka JBossEAP or EAP) before 4.2.0.CP03, and 4.3.0 before 4.3.0.CP01, allows remote attackers to obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string.

Affected products

• JBoss Enterprise Application Platform: up to and including 4.2.0.cp03; up to and including 4.3.0; version 4.2.0.cp01 only; version 4.2.0.cp02 only

Published 2008-08-10. Last modified 2026-06-16.