GHSA-hfpg-gqjw-779m

Cross-site Scripting in Jolokia agent

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-1000129

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jolokia:jolokia-core	>= 1.3.7, < 1.5.0	1.5.0

Details

As written in the advisory (Markdown source, shown as plain text).

An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1000129 advisory
https://github.com/rhuss/jolokia/commit/5895d5c137c335e6b473e9dcb9baf748851bbc5f#diff-f19898247eddb55de6400489bff748ad web
https://access.redhat.com/errata/RHSA-2018:2669 web
https://access.redhat.com/errata/RHSA-2018:3817 web
https://github.com/rhuss/jolokia package
https://github.com/rhuss/jolokia/releases/tag/v1.5.0 web
https://jolokia.org/#Security_fixes_with_1.5.0 web