Jolokia Agent - JNDI Code Injection

Jolokia agent is vulnerable to a JNDI injection vulnerability that allows a remote attacker to run arbitrary Java code on the server when the agent is in proxy mode. id: CVE-2018-1000130 info: name: Jolokia Agent - JNDI Code Injection author: milo2012 severity: high description: | Jolokia agent i...

CVE-2018-1000130

creationtimestamp| type| source ---|---|--- 2024-12-25 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2024-12-25 2024-12-26 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2024-12-26 2024-12-27 00:00:00+00:00| seen| The Shadowserver...

VulnCheck KEV: CVE-2018-1000130

A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to run arbitrary Java code on the server...

cn.home1:spring-cloud-eureka-server (>=0.0.1 <=1.0.1.U1), com.github.springcloud:moss-client-1.x (=1.0.1.RELEASE) +162 more potentially affected by CVE-2018-1000130 via org.jolokia:jolokia-core (>=1.3.7 <=1.4.0)

org.jolokia:jolokia-core MAVEN version =1.3.7, =0.0.1, =1.2.0, =1.5.4, =1.5.4, =1.5.4, =1.5.4, =1.5.4, =1.5.4, =1.5.4, =0.1.5, =0.1.5, =2.0-beta-1, =2.3.0, =2.7.1 and more Source cves: CVE-2018-1000130 Source advisory: OSV:GHSA-RHQJ-4PP8-VVGF...

Important: Red Hat Security Advisory: Fuse 7.1 security update

An update is now available for Red Hat Fuse. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Jolokia Vulnerabilities - RCE & XSS(CVE-2018-1000130,CVE-2018-1000129)

Recently, during a client engagement, Gotham Digital Science found a couple of zero-day vulnerabilities in the Jolokia service. Jolokia is an open source product that provides an HTTP API interface for JMX Java Management Extensions technology. It contains an API we can use for calling MBeans...

CVE-2018-1000130

A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to run arbitrary Java code on the server...