GitHub Advisoryadvisory · Maven

GHSA-q4q2-fvwf-6ghv Cross-Site Request Forgery in hawtio

HIGH Published 2022-05-13 Modified 2022-11-04 Official page ↗
Aliases
CVE-2017-7556
Ecosystem
Maven
Packages
io.hawt:project
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2022-11-04

Affected packages

• Maven io.hawt:project: < 1.5.4 → fixed in 1.5.4

Description

It was found that hawtio contains a CSRF flaw that allows unrelated websites to perform actions as the authenticated user. Attackers could use this vulnerability to trick the user to visit his website that contains a malicious script which can be submitted to hawtio server on behalf of the user.

Related

Alias · CVE (1)

  • CVE-2017-7556 Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References