CVE-2017-2589
published 2018-07-26CVE-2017-2589: It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally…
PriorityP336critical9CVSS 3.0
AVNACLPRLUIRSCCHIHAH
EPSS
0.93%
56.0th percentile
It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hawt | hawtio | — | — |
| red_hat | hawtio | — | — |
| redhat | jboss_fuse | — | — |
CVSS provenance
nvdv3.09.0CRITICALCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
nvdv2.06.0MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
hawtio: Proxy is sharing cookies among all the clients
vendor_redhat·2017-07-28·CVSS 8.7
CVE-2017-2589 [HIGH] CWE-285 hawtio: Proxy is sharing cookies among all the clients
hawtio: Proxy is sharing cookies among all the clients
It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.
It was discovered that the hawtio servlet uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.
Package: hawtio (Red Hat JBoss A-MQ 6) - Affected
Package: hawtio (Red Hat JBoss Fuse 6) - Affected
Package: hawtio (Red Hat OpenShift Enterprise 2) - Under investigation
OSV
Insecure cookie sharing in Hawtio
osv·2022-05-13
CVE-2017-2589 [CRITICAL] Insecure cookie sharing in Hawtio
Insecure cookie sharing in Hawtio
It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.
GHSA
Insecure cookie sharing in Hawtio
ghsa·2022-05-13
CVE-2017-2589 [CRITICAL] CWE-200 Insecure cookie sharing in Hawtio
Insecure cookie sharing in Hawtio
It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.
No detection rules found.
No public exploits indexed.
2018-07-26
Published