GHSA-q4q2-fvwf-6ghv

    Dashboard / Vulnerabilities / GHSA-q4q2-fvwf-6ghv

    GHSA-q4q2-fvwf-6ghv

    Published: 13 May 2022Last Modified: 8 Nov 2023
    Aliases:
    CVE-2017-7556

    Summary: Cross-Site Request Forgery in hawtio

    Details: It was found that hawtio contains a CSRF flaw that allows unrelated websites to perform actions as the authenticated user. Attackers could use this vulnerability to trick the user to visit his website that contains a malicious script which can be submitted to hawtio server on behalf of the user.

    References: https://nvd.nist.gov/vuln/detail/CVE-2017-7556, https://bugzilla.redhat.com/show_bug.cgi?id=1480060, https://github.com/hawtio/hawtio

    Affected packages

    Package

    Name: io.hawt:project

    Purl: pkg:maven/io.hawt/project

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.5.4

    Affected versions

    1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High