PT-2018-7119 · Hawtio · Hawtio Servlet

Adam Mariš · Publicado 2018-07-26 · Atualizado 2022-05-13 · CVE-2017-2589

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: hawtio servlet version 1.4

Description: A issue was found where the hawtio servlet uses a single HttpClient instance to proxy requests, resulting in all clients sharing the same cookies due to a persistent cookie store. This means cookies are stored locally and not passed between the client and the end URL.

Recommendations: For hawtio servlet version 1.4, consider disabling the proxy functionality until a patch is available to prevent cookie sharing among clients. Restrict access to the hawtio servlet to minimize the risk of exploitation.

Correção

Information Disclosure

Improper Authorization

Enumeração de Fraquezas

CWE-200

CWE-285

Identificadores relacionados

CVE-2017-2589

GHSA-M4J5-HGQQ-5JF2

Produtos afetados

Hawtio Servlet

Referências · 7

• https://github.com/hawtio/hawtio · Nota
• https://osv.dev/vulnerability/GHSA-m4j5-hgqq-5jf2 · Aviso do Fabricante
• https://tadayoshi-sato.medium.com/securing-hawtio-f5fbfd5afcf0 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2589 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-2589 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:1832 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-2589 · Nota de Segurança