Описание
Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat JBoss A-MQ 6 | hawtio | Out of support scope | ||
| Red Hat JBoss Fuse 6 | hawtio | Out of support scope | ||
| Red Hat AMQ | hawtio | Fixed | RHSA-2020:4154 | 01.10.2020 |
| Red Hat AMQ | Fixed | RHSA-2020:5365 | 08.12.2020 | |
| Red Hat Fuse 6.3 | hawtio | Fixed | RHSA-2020:3587 | 01.09.2020 |
| Red Hat Fuse 7.7.0 | hawtio | Fixed | RHSA-2020:3192 | 28.07.2020 |
Показывать по
10
Дополнительная информация
Статус:
Moderate
Дефект:
CWE-602
https://bugzilla.redhat.com/show_bug.cgi?id=1728604hawtio: server side request forgery via initial /proxy/ substring of a URI
5.5 Medium
CVSS3
Связанные уязвимости
CVSS3: 9.8
nvd
больше 6 лет назад
Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI.
5.5 Medium
CVSS3