PT-2018-9305 · Jolokia · Jolokia Agent

Published 2018-03-14 · Updated 2022-05-14 · CVE-2018-1000130

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Jolokia agent version 1.3.7

Description: A JNDI Injection issue exists in the proxy mode, allowing a remote attacker to run arbitrary Java code on the server.

Recommendations: For Jolokia agent version 1.3.7, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2018-1000130

GHSA-RHQJ-4PP8-VVGF

Affected Products

Jolokia Agent

References · 10

• 🔥 https://blog.gdssecurity.com/labs/2018/4/18/jolokia-vulnerabilities-rce-xss.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000130 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1000130 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2669 · Vendor Advisory
• https://jolokia.org/#Security_fixes_with_1.5.0 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rhqj-4pp8-vvgf · Vendor Advisory
• https://github.com/rhuss/jolokia · Note
• https://github.com/rhuss/jolokia/releases/tag/v1.5.0 · Note
• https://github.com/rhuss/jolokia/commit/fd7b93da30c61a45bac10d8b311f1b79a74910f5 · Note
• https://github.com/rhuss/jolokia/commit/1b360b8889f0ed51165a8d1ac55dd8e0aa2dfd4a · Note