CVE:CVE-2009-0027
CNNVD:CNNVD-200903-173
JBoss Enterprise Application Platform (又称JBoss EAP或JBEAP) 4.2.0.CP06之前的版本4.2以及4.3.0.CP04之前的版本4.3中的JBossWS的请求处理程序没有适当地在对具有一个客户网络服务终端的WSDL文件的请求中校验资源路径，这会允许远程攻击者可以借助一个特制的请求，读取任意XML文件。
solution:Upgrade redhat jboss_enterprise_application_platform to a higher version than 4.2.0:cp01,4.2.0:cp02,4.2.0:cp03,4.2.0:cp04,4.2.0:cp05,4.2.0:cp06,4.3.0:cp01,4.3.0:cp02,4.3.0:cp03,4.3.0:cp04,and avoid the version 4.2.0:cp01,4.2.0:cp02,4.2.0:cp03,4.2.0:cp04,4.2.0:cp05,4.2.0:cp06,4.3.0:cp01,4.3.0:cp02,4.3.0:cp03,4.3.0:cp04