Insecure cookie sharing in Hawtio

Also known as GHSA-m4j5-hgqq-5jf2

Published 8 y ago 2018-07-26 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.7

v3.0 · CNA

CISA KEV

not known exploited

EPSS

0.9%

percentile 61%

Public exploits

none known

It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.

Exploit prediction (EPSS)

0.93% probability of exploitation in the next 30 days, higher than 61% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	8.7	`CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N`
CNA	3.0	8.7	`CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N`
NVD	3.0	9.0	`CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H`
NVD	2.0	6.0	`AV:N/AC:M/Au:S/C:P/I:P/A:P`
GitHub	3.0	9.0	`CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`io.hawt:project`	<1.5.0	1.5.0

Affected products

Red Hat hawtio

Classification

Weakness

CWE-285 Improper Authorization
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

access.redhat.com /errata/RHSA-2017:1832 · vendor-advisory, x_refsource_REDHAT, x_transferred
bugzilla.redhat.com /show_bug.cgi?id=CVE-2017-2589 · x_refsource_CONFIRM, x_transferred
nvd.nist.gov /vuln/detail/CVE-2017-2589 · advisory
github.com /hawtio/hawtio · package
tadayoshi-sato.medium.com /securing-hawtio-f5fbfd5afcf0 · web

Sources

CVE List: CVE-2017-2589
GitHub Advisory: GHSA-m4j5-hgqq-5jf2
NVD: CVE-2017-2589

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary