CVE-2014-0120 Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arbitrary users for requests that run commands on the Karaf ser...
HighCVSS 8.8
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arbitrary users for requests that run commands on the Karaf server, as demonstrated by running "shutdown -f."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hawtio | <= 1.2.2 | No fix listed |
| redhat jboss fuse | = 6.1.0-beta | No fix listed |
References
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- github.com issue-tracking patch third-party-advisory
- infocon.org issue-tracking third-party-advisory