CVE-2017-2589 Insecure cookie sharing in Hawtio
CriticalCVSS 9.0
EPSS 0.93%
- Published
- Updated
- Exploit status
- No public exploit known
Description
It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| io.hawt/project(Maven) | < 1.5.0 | 1.5.0 |
| io.hawt/project(Maven) | = 1.0 | No fix listed |
| io.hawt/project(Maven) | = 1.1 | No fix listed |
| io.hawt/project(Maven) | = 1.2-M1 | No fix listed |
| io.hawt/project(Maven) | = 1.2-M10 | No fix listed |
| io.hawt/project(Maven) | = 1.2-M11 | No fix listed |
| io.hawt/project(Maven) | = 1.2-M13 | No fix listed |
| io.hawt/project(Maven) | = 1.2-M14 | No fix listed |
| io.hawt/project(Maven) | = 1.2-M16 | No fix listed |
| io.hawt/project(Maven) | = 1.2-M19 | No fix listed |
| io.hawt/project(Maven) | = 1.2-M2 | No fix listed |
| io.hawt/project(Maven) | = 1.2-M20 | No fix listed |
| io.hawt/project(Maven) | = 1.2-M22 | No fix listed |
| io.hawt/project(Maven) | = 1.2-M23 | No fix listed |
| io.hawt/project(Maven) | = 1.2-M24 | No fix listed |
| io.hawt/project(Maven) | = 1.2-M25 | No fix listed |
| io.hawt/project(Maven) | = 1.2-M26 | No fix listed |
| io.hawt/project(Maven) | = 1.2-M27 | No fix listed |
| io.hawt/project(Maven) | = 1.2-M3 | No fix listed |
| io.hawt/project(Maven) | = 1.2-M4 | No fix listed |
| io.hawt/project(Maven) | = 1.2-M5 | No fix listed |
| io.hawt/project(Maven) | = 1.2-M6 | No fix listed |
| io.hawt/project(Maven) | = 1.2-M7 | No fix listed |
| io.hawt/project(Maven) | = 1.2-M8 | No fix listed |
| io.hawt/project(Maven) | = 1.2-M9 | No fix listed |
Show 76 more
| Product | Affected versions | Fixed in |
|---|---|---|
| io.hawt/project(Maven) | = 1.2.0 | No fix listed |
| io.hawt/project(Maven) | = 1.2.1 | No fix listed |
| io.hawt/project(Maven) | = 1.2.2 | No fix listed |
| io.hawt/project(Maven) | = 1.2.3 | No fix listed |
| io.hawt/project(Maven) | = 1.3.0 | No fix listed |
| io.hawt/project(Maven) | = 1.3.1 | No fix listed |
| io.hawt/project(Maven) | = 1.4.0 | No fix listed |
| io.hawt/project(Maven) | = 1.4.1 | No fix listed |
| io.hawt/project(Maven) | = 1.4.10 | No fix listed |
| io.hawt/project(Maven) | = 1.4.11 | No fix listed |
| io.hawt/project(Maven) | = 1.4.12 | No fix listed |
| io.hawt/project(Maven) | = 1.4.14 | No fix listed |
| io.hawt/project(Maven) | = 1.4.15 | No fix listed |
| io.hawt/project(Maven) | = 1.4.16 | No fix listed |
| io.hawt/project(Maven) | = 1.4.17 | No fix listed |
| io.hawt/project(Maven) | = 1.4.18 | No fix listed |
| io.hawt/project(Maven) | = 1.4.19 | No fix listed |
| io.hawt/project(Maven) | = 1.4.2 | No fix listed |
| io.hawt/project(Maven) | = 1.4.20 | No fix listed |
| io.hawt/project(Maven) | = 1.4.21 | No fix listed |
| io.hawt/project(Maven) | = 1.4.22 | No fix listed |
| io.hawt/project(Maven) | = 1.4.23 | No fix listed |
| io.hawt/project(Maven) | = 1.4.24 | No fix listed |
| io.hawt/project(Maven) | = 1.4.25 | No fix listed |
| io.hawt/project(Maven) | = 1.4.26 | No fix listed |
| io.hawt/project(Maven) | = 1.4.27 | No fix listed |
| io.hawt/project(Maven) | = 1.4.28 | No fix listed |
| io.hawt/project(Maven) | = 1.4.29 | No fix listed |
| io.hawt/project(Maven) | = 1.4.30 | No fix listed |
| io.hawt/project(Maven) | = 1.4.31 | No fix listed |
| io.hawt/project(Maven) | = 1.4.32 | No fix listed |
| io.hawt/project(Maven) | = 1.4.33 | No fix listed |
| io.hawt/project(Maven) | = 1.4.34 | No fix listed |
| io.hawt/project(Maven) | = 1.4.35 | No fix listed |
| io.hawt/project(Maven) | = 1.4.36 | No fix listed |
| io.hawt/project(Maven) | = 1.4.37 | No fix listed |
| io.hawt/project(Maven) | = 1.4.38 | No fix listed |
| io.hawt/project(Maven) | = 1.4.39 | No fix listed |
| io.hawt/project(Maven) | = 1.4.4 | No fix listed |
| io.hawt/project(Maven) | = 1.4.40 | No fix listed |
| io.hawt/project(Maven) | = 1.4.41 | No fix listed |
| io.hawt/project(Maven) | = 1.4.42 | No fix listed |
| io.hawt/project(Maven) | = 1.4.43 | No fix listed |
| io.hawt/project(Maven) | = 1.4.44 | No fix listed |
| io.hawt/project(Maven) | = 1.4.45 | No fix listed |
| io.hawt/project(Maven) | = 1.4.46 | No fix listed |
| io.hawt/project(Maven) | = 1.4.47 | No fix listed |
| io.hawt/project(Maven) | = 1.4.48 | No fix listed |
| io.hawt/project(Maven) | = 1.4.49 | No fix listed |
| io.hawt/project(Maven) | = 1.4.5 | No fix listed |
| io.hawt/project(Maven) | = 1.4.50 | No fix listed |
| io.hawt/project(Maven) | = 1.4.51 | No fix listed |
| io.hawt/project(Maven) | = 1.4.52 | No fix listed |
| io.hawt/project(Maven) | = 1.4.53 | No fix listed |
| io.hawt/project(Maven) | = 1.4.54 | No fix listed |
| io.hawt/project(Maven) | = 1.4.55 | No fix listed |
| io.hawt/project(Maven) | = 1.4.56 | No fix listed |
| io.hawt/project(Maven) | = 1.4.57 | No fix listed |
| io.hawt/project(Maven) | = 1.4.58 | No fix listed |
| io.hawt/project(Maven) | = 1.4.59 | No fix listed |
| io.hawt/project(Maven) | = 1.4.6 | No fix listed |
| io.hawt/project(Maven) | = 1.4.60 | No fix listed |
| io.hawt/project(Maven) | = 1.4.61 | No fix listed |
| io.hawt/project(Maven) | = 1.4.62 | No fix listed |
| io.hawt/project(Maven) | = 1.4.63 | No fix listed |
| io.hawt/project(Maven) | = 1.4.64 | No fix listed |
| io.hawt/project(Maven) | = 1.4.65 | No fix listed |
| io.hawt/project(Maven) | = 1.4.66 | No fix listed |
| io.hawt/project(Maven) | = 1.4.67 | No fix listed |
| io.hawt/project(Maven) | = 1.4.68 | No fix listed |
| io.hawt/project(Maven) | = 1.4.7 | No fix listed |
| io.hawt/project(Maven) | = 1.4.8 | No fix listed |
| io.hawt/project(Maven) | = 1.4.9 | No fix listed |
| hawtio | = 1.4.0 | No fix listed |
| redhat jboss fuse | = 6.3 | No fix listed |
| redhat hawtio | = 1.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- RHSA-2017:1832 vendor-advisory
- bugzilla.redhat.com issue-tracking vendor-advisory
- tadayoshi-sato.medium.com
- github.com
- github.com product