GitHub Advisoryadvisory · Maven

GHSA-xcxf-7q4p-cj26 Cross-Site Request Forgery in Jolokia

HIGH Published 2022-05-24 Modified 2022-06-29 Official page ↗
Aliases
CVE-2018-10899
Ecosystem
Maven
Packages
org.jolokia:jolokia-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2022-06-29

Affected packages

• Maven org.jolokia:jolokia-core: >= 1.2, < 1.6.1 → fixed in 1.6.1

Description

A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured instances with strict checking for origin and referrer headers. This could result in a Remote Code Execution attack.

Related

Alias · CVE (1)

  • CVE-2018-10899 A flaw was found in Jolokia versions from 1.2 to before 1.6.1. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References