PT-2018-9305 · Jolokia · Jolokia Agent

Publicado 2018-03-14 · Atualizado 2022-05-14 · CVE-2018-1000130

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Jolokia agent version 1.3.7

Description: A JNDI Injection issue exists in the proxy mode, allowing a remote attacker to run arbitrary Java code on the server.

Recommendations: For Jolokia agent version 1.3.7, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2018-1000130

GHSA-RHQJ-4PP8-VVGF

Produtos afetados

Jolokia Agent

Referências · 10

• 🔥 https://blog.gdssecurity.com/labs/2018/4/18/jolokia-vulnerabilities-rce-xss.html · Exploit
• https://github.com/rhuss/jolokia · Nota
• https://github.com/rhuss/jolokia/releases/tag/v1.5.0 · Nota
• https://github.com/rhuss/jolokia/commit/fd7b93da30c61a45bac10d8b311f1b79a74910f5 · Nota
• https://github.com/rhuss/jolokia/commit/1b360b8889f0ed51165a8d1ac55dd8e0aa2dfd4a · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000130 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-1000130 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:2669 · Aviso do Fabricante
• https://jolokia.org/#Security_fixes_with_1.5.0 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-rhqj-4pp8-vvgf · Aviso do Fabricante