PT-2019-8770 · Jolokia · Jolokia

Laura Pardo · Published 2019-08-01 · Updated 2022-05-24 · CVE-2018-10899

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jolokia versions 1.2 through 1.6.0

Description A flaw in the software makes it vulnerable to a system-wide CSRF attack, even in properly configured instances with strict checking for origin and referrer headers. This could potentially result in a Remote Code Execution attack.

Recommendations For Jolokia versions 1.2 through 1.6.0, update to version 1.6.1 or later to resolve the issue.

Fix

RCE

CSRF

Weakness Enumeration

CWE-20

CWE-352

Related Identifiers

CVE-2018-10899

GHSA-XCXF-7Q4P-CJ26

Affected Products

Jolokia

References · 21

• https://nvd.nist.gov/vuln/detail/CVE-2018-10899 · Security Note
• https://access.redhat.com/errata/RHSA-2019:2413 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:2804 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xcxf-7q4p-cj26 · Vendor Advisory
• https://jolokia.org/changes-report.html#a1.6.1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-10899 · Vendor Advisory
• https://lists.apache.org/thread.html/rf33ffbba619a4281ce592a6ed259c07a557aefb4975619d83c4122ea@%3Cissues.activemq.apache.org%3E · Note
• https://lists.apache.org/thread.html/r67cdc50af9caf89c9ebe1bde08393a343dcd89edba1c63677f68f43b@%3Cissues.activemq.apache.org%3E · Note
• https://lists.apache.org/thread.html/r64701caec91c43efd7416d6bddef88447371101e00e8562741ede262%40%3Cissues.activemq.apache.org%3E · Note
• https://lists.apache.org/thread.html/r67cdc50af9caf89c9ebe1bde08393a343dcd89edba1c63677f68f43b%40%3Cissues.activemq.apache.org%3E · Note
• https://lists.apache.org/thread.html/r64701caec91c43efd7416d6bddef88447371101e00e8562741ede262@%3Cissues.activemq.apache.org%3E · Note
• https://lists.apache.org/thread.html/rc169dac018d07e8ddf2a3bb2fd1efc6cbda4f83f1bbf7a8c798e7f4f@%3Cissues.activemq.apache.org%3E · Note
• https://lists.apache.org/thread.html/rc169dac018d07e8ddf2a3bb2fd1efc6cbda4f83f1bbf7a8c798e7f4f%40%3Cissues.activemq.apache.org%3E · Note
• https://lists.apache.org/thread.html/rdb0a59d7851e721b75beea13d6488e345a3e2735838e89d9269d7d32%40%3Cissues.activemq.apache.org%3E · Note
• https://lists.apache.org/thread.html/r46f6dbc029f49e1f638c6eb82accb94b7f990d818cb3b3bc0007dd0a@%3Cissues.activemq.apache.org%3E · Note