CVE-2018-10899
published 2019-08-01CVE-2018-10899: A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured…
PriorityP351high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EPSS
2.67%
84.0th percentile
A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured instances with strict checking for origin and referrer headers. This could result in a Remote Code Execution attack.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jolokia | jolokia | — | — |
| jolokia | jolokia | >= 1.2.0 < 1.6.1 | 1.6.1 |
| redhat | openstack | — | — |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Cross-Site Request Forgery in Jolokia
ghsa·2022-05-24
CVE-2018-10899 [HIGH] CWE-352 Cross-Site Request Forgery in Jolokia
Cross-Site Request Forgery in Jolokia
A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured instances with strict checking for origin and referrer headers. This could result in a Remote Code Execution attack.
OSV
Cross-Site Request Forgery in Jolokia
osv·2022-05-24
CVE-2018-10899 [HIGH] Cross-Site Request Forgery in Jolokia
Cross-Site Request Forgery in Jolokia
A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured instances with strict checking for origin and referrer headers. This could result in a Remote Code Execution attack.
Red Hat
jolokia: system-wide CSRF that could lead to Remote Code Execution
vendor_redhat·2019-06-11·CVSS 8.1
CVE-2018-10899 [HIGH] CWE-20 jolokia: system-wide CSRF that could lead to Remote Code Execution
jolokia: system-wide CSRF that could lead to Remote Code Execution
A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured instances with strict checking for origin and referrer headers. This could result in a Remote Code Execution attack.
A flaw was found in Jolokia, versions 1.2 through 1.6.0, where Jolokia did not correctly handle checking for origin and referrer headers when strict checking was enabled. An attacker could use this vulnerability to conduct cross-site request forgery or further attacks.
Statement: In Red Hat OpenStack Platform, jolokia is not enabled by default and, when enabled, the jolokia endpoints do not rely on CORS for security. Therefore, the impact has been re
No detection rules found.
No public exploits indexed.
https://access.redhat.com/errata/RHSA-2019:2413https://access.redhat.com/errata/RHSA-2019:2804https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10899https://jolokia.org/changes-report.html#a1.6.1https://lists.apache.org/thread.html/1392fbebb4fbbec379a40d16e1288fe1e4c0289d257e5206051a3793%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/r46f6dbc029f49e1f638c6eb82accb94b7f990d818cb3b3bc0007dd0a%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/r64701caec91c43efd7416d6bddef88447371101e00e8562741ede262%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/r67cdc50af9caf89c9ebe1bde08393a343dcd89edba1c63677f68f43b%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/rc169dac018d07e8ddf2a3bb2fd1efc6cbda4f83f1bbf7a8c798e7f4f%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/rdb0a59d7851e721b75beea13d6488e345a3e2735838e89d9269d7d32%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/rf33ffbba619a4281ce592a6ed259c07a557aefb4975619d83c4122ea%40%3Cissues.activemq.apache.org%3Ehttps://access.redhat.com/errata/RHSA-2019:2413https://access.redhat.com/errata/RHSA-2019:2804https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10899https://jolokia.org/changes-report.html#a1.6.1https://lists.apache.org/thread.html/1392fbebb4fbbec379a40d16e1288fe1e4c0289d257e5206051a3793%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/r46f6dbc029f49e1f638c6eb82accb94b7f990d818cb3b3bc0007dd0a%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/r64701caec91c43efd7416d6bddef88447371101e00e8562741ede262%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/r67cdc50af9caf89c9ebe1bde08393a343dcd89edba1c63677f68f43b%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/rc169dac018d07e8ddf2a3bb2fd1efc6cbda4f83f1bbf7a8c798e7f4f%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/rdb0a59d7851e721b75beea13d6488e345a3e2735838e89d9269d7d32%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/rf33ffbba619a4281ce592a6ed259c07a557aefb4975619d83c4122ea%40%3Cissues.activemq.apache.org%3E
2019-08-01
Published