Description

Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI.

Remediation

References

https://www.ciphertechs.com/hawtio-advisory/

Related Vulnerabilities

CVE-2021-40865 Vulnerability in maven package org.apache.storm:storm-server

CVE-2020-7767 Vulnerability in npm package express-validators

CVE-2018-16461 Vulnerability in npm package libnmap

CVE-2021-33813 Vulnerability in maven package org.jdom:jdom

CVE-2022-25890 Vulnerability in npm package wifey

Severity

Critical

Classification

CWE-918 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Third Party Advisory