CVE-2018-10899 — Improper Input Validation in Jolokia

CWE-20 — Improper Input ValidationCWE-352 — Cross-Site Request Forgery6 documents6 sources
Severity
8.8HIGHNVD
CNA8.1
EPSS
2.1%
top 15.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
JolokiaRedhat Openstack
Timeline
PublishedAug 1
Latest updateMay 24

Description

A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured instances with strict checking for origin and referrer headers. This could result in a Remote Code Execution attack.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶NVDjolokia/jolokia1.2.0 — 1.6.1
▶CVEListV5jolokia/jolokia1.6.1

🔴Vulnerability Details

3
GHSA
Cross-Site Request Forgery in Jolokia↗2022-05-24
▶
OSV
Cross-Site Request Forgery in Jolokia↗2022-05-24
▶
CVEList
CVE-2018-10899: A flaw was found in Jolokia versions from 1↗2019-08-01
▶

📋Vendor Advisories

1
Red Hat
jolokia: system-wide CSRF that could lead to Remote Code Execution↗2019-06-11
▶

💬Community

1
Bugzilla
CVE-2018-10899 jolokia: system-wide CSRF that could lead to Remote Code Execution↗2018-07-13
▶
CVE-2018-10899 — Improper Input Validation in Jolokia | cvebase