Description
A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured instances with strict checking for origin and referrer headers. This could result in a Remote Code Execution attack.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jolokia | jolokia | 1.6.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jolokia:jolokia-core | >= 1.2, < 1.6.1 | 1.6.1 | GHSA-xcxf-7q4p-cj26 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10899
- https://jolokia.org/changes-report.html#a1.6.1
- RHSA-2019:2413 vendor-advisory
- RHSA-2019:2804 vendor-advisory
- [activemq-issues] 20200102 [jira] [Created] (AMQ-7373) jolokia-core-1.6.0.jar is vulnerable to CVE-2018-10899 mailing-list
- [activemq-issues] 20200120 [jira] [Work logged] (AMQ-7373) jolokia-core-1.6.0.jar is vulnerable to CVE-2018-10899 mailing-list
- [activemq-issues] 20200122 [jira] [Updated] (AMQ-7373) jolokia-core-1.6.0.jar is vulnerable to CVE-2018-10899 mailing-list
- [activemq-issues] 20200122 [jira] [Assigned] (AMQ-7373) jolokia-core-1.6.0.jar is vulnerable to CVE-2018-10899 mailing-list
- [activemq-issues] 20200122 [jira] [Commented] (AMQ-7373) jolokia-core-1.6.0.jar is vulnerable to CVE-2018-10899 mailing-list
- [activemq-issues] 20200122 [jira] [Work logged] (AMQ-7373) jolokia-core-1.6.0.jar is vulnerable to CVE-2018-10899 mailing-list
- [activemq-issues] 20200122 [jira] [Resolved] (AMQ-7373) jolokia-core-1.6.0.jar is vulnerable to CVE-2018-10899 mailing-list