GHSA-m4j5-hgqq-5jf2

ghsaUSosv

Insecure cookie sharing in Hawtio

view advisory published 2022-05-13Licence: CC-BY-4.0

It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-2589US	critical9.0	0.93% (60th)	—	2018-07-26
It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed betw…

references

External citations — patches, advisories, analysis.

https://access.redhat.com/errata/RHSA-2017:1832WEB
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2589WEB
https://github.com/hawtio/hawtioPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2017-2589ADVISORY
https://tadayoshi-sato.medium.com/securing-hawtio-f5fbfd5afcf0WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan