Cross site request forgery (csrf)

2017-12-2922:29:00

PRIOn knowledge base

www.prio-n.com

8 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

59.9%

JSON

Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arbitrary users for requests that run commands on the Karaf server, as demonstrated by running “shutdown -f.”

CPENameOperatorVersion
hawtiole1.2.2
jboss_fuseeq6.1.0 beta

CPE	Name	Operator	Version
	hawtio	le	1.2.2
	jboss_fuse	eq	6.1.0 beta

References

bugzilla.redhat.com/show_bug.cgi?id=1072681

github.com/hawtio/hawtio/commit/b4e23e002639c274a2f687ada980118512f06113

infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdf