CVE-2017-2594

hawtio before versions 2.0-beta-1, 2.0-beta-2 2.0-m1, 2.0-m2, 2.0-m3, and 1.5 is vulnerable to a path traversal that leads to a NullPointerException with a full stacktrace. An attacker could use this flaw to gather undisclosed information from within hawtio's root.

Score

CVSS 3.0 7.5 High

Status

Modified - secalert@redhat.com

Published

2018-05-08

Last modified

2024-08-05

Weaknesses

CWE-209, CWE-22

Affected products

• Hawtio (Hawt)
• Hawtio (Unspecified)

References

• http://www.securityfocus.com/bid/95793
• https://access.redhat.com/errata/RHSA-2017:1832
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2594