Cross-Site Request Forgery in hawtio

2022-05-1301:36:16

Google

osv.dev

0.002 Low

EPSS

Percentile

53.2%

JSON

It was found that hawtio contains a CSRF flaw that allows unrelated websites to perform actions as the authenticated user. Attackers could use this vulnerability to trick the user to visit his website that contains a malicious script which can be submitted to hawtio server on behalf of the user.

CPENameOperatorVersion
io.hawt:projecteq1.2-M22
io.hawt:projecteq1.4.20
io.hawt:projecteq1.2-M19
io.hawt:projecteq1.2-M24
io.hawt:projecteq1.4.22
io.hawt:projecteq1.4.17
io.hawt:projecteq1.4.10
io.hawt:projecteq1.4.33
io.hawt:projecteq1.4.57
io.hawt:projecteq1.4.56

Name	Operator	Version
io.hawt:project	eq	1.2-M22
io.hawt:project	eq	1.4.20
io.hawt:project	eq	1.2-M19
io.hawt:project	eq	1.2-M24
io.hawt:project	eq	1.4.22
io.hawt:project	eq	1.4.17
io.hawt:project	eq	1.4.10
io.hawt:project	eq	1.4.33
io.hawt:project	eq	1.4.57
io.hawt:project	eq	1.4.56