CVE-2017-7556: Cross-Site Request Forgery in hawtio
8.8
CVSS Score
3.0
Basic Information
CVE ID
GHSA ID
EPSS Score
0.48356%
CWE
Published
5/13/2022
Updated
2/2/2023
KEV Status
No
Technology
Java
Technical Details
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
io.hawt:project | maven | < 1.5.4 | 1.5.4 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability description and mitigation steps explicitly reference improper CORS configuration in Jolokia (via jolokia-access.xml
). Hawtio relies on Jolokia for JMX-over-HTTP communication, and the lack of strict origin checking in Jolokia's default configuration allowed cross-origin requests to execute privileged actions. The absence of CSRF tokens or origin validation in the affected endpoints made them vulnerable. While no specific function names are provided in the advisory, the root cause lies in Jolokia's CORS handling logic, which is part of hawtio's integration with Jolokia.