Description

hawtio before version 1.5.5 is vulnerable to remote code execution via file upload. An attacker could use this vulnerability to upload a crafted file which could be executed on a target machine where hawtio is deployed.

Remediation

References

http://www.securityfocus.com/bid/96036

https://access.redhat.com/errata/RHSA-2018:0319

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2617

Related Vulnerabilities

CVE-2017-15881 Vulnerability in npm package keystone

CVE-2020-7611 Vulnerability in maven package io.micronaut:micronaut-http-client

CVE-2020-17533 Vulnerability in maven package org.apache.accumulo:accumulo-core

CVE-2016-6797 Vulnerability in maven package tomcat:catalina

CVE-2022-25869 Vulnerability in npm package angular

Severity

High

Classification

CWE-434 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Third Party Advisory VDB Entry Issue Tracking