~ / search / GHSA-xcxf-7q4p-cj26

GHSA-xcxf-7q4p-cj26

Cross-Site Request Forgery in Jolokia

Source: GitHub Advisory Database (reviewed) High CVE-2018-10899

Packages

EcosystemPackageAffectedFixed in
Maven org.jolokia:jolokia-core >= 1.2, < 1.6.1 1.6.1

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured instances with strict checking for origin and referrer headers. This could result in a Remote Code Execution attack.

References

External links from the advisory. They lead to third-party sites.