PT-2018-7119 · Hawtio · Hawtio Servlet

Adam Mariš · Published 2018-07-26 · Updated 2022-05-13 · CVE-2017-2589

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: hawtio servlet version 1.4

Description: A issue was found where the hawtio servlet uses a single HttpClient instance to proxy requests, resulting in all clients sharing the same cookies due to a persistent cookie store. This means cookies are stored locally and not passed between the client and the end URL.

Recommendations: For hawtio servlet version 1.4, consider disabling the proxy functionality until a patch is available to prevent cookie sharing among clients. Restrict access to the hawtio servlet to minimize the risk of exploitation.

Fix

Information Disclosure

Improper Authorization

Weakness Enumeration

CWE-200

CWE-285

Related Identifiers

CVE-2017-2589

GHSA-M4J5-HGQQ-5JF2

Affected Products

Hawtio Servlet

References · 7

• https://osv.dev/vulnerability/GHSA-m4j5-hgqq-5jf2 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2589 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-2589 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:1832 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-2589 · Security Note
• https://github.com/hawtio/hawtio · Note
• https://tadayoshi-sato.medium.com/securing-hawtio-f5fbfd5afcf0 · Note