GitHub Advisoryadvisory · Maven

GHSA-mcg9-64cp-xwp7 Server-Side Request Forgery in Hawt Hawtio

CRITICAL Published 2019-07-05 Modified 2021-08-17 Official page ↗
Aliases
CVE-2019-9827
Ecosystem
Maven
Packages
io.hawt:hawtio-core
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-918
Reviewed
2019-07-05

Affected packages

• Maven io.hawt:hawtio-core: < 2.5.0 → fixed in 2.5.0

Description

Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI.

Related

Alias · CVE (1)

  • CVE-2019-9827 Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References