GitHub Advisoryadvisory · Maven

GHSA-m4j5-hgqq-5jf2 Insecure cookie sharing in Hawtio

CRITICAL Published 2022-05-13 Modified 2022-11-04 Official page ↗
Aliases
CVE-2017-2589
Ecosystem
Maven
Packages
io.hawt:project
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-200
Reviewed
2022-11-04

Affected packages

• Maven io.hawt:project: < 1.5.0 → fixed in 1.5.0

Description

It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.

Related

Alias · CVE (1)

  • CVE-2017-2589 It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References