What is CVE-2017-2589?

CVE-2017-2589 is a high-severity vulnerability in Hawt Hawtio, classified under Improper Authorization. CVSS score: 8.7/10. Published 2018-07-26.

How severe is CVE-2017-2589?

High severity. CVSS v3 base score is 8.7 out of 10.

Auth bypass in Hawt Hawtio

CVE-2017-2589

It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients usi…

EPSS: 0.009 (56.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.7 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N.

Affected products

Hawt Hawtio — versions 1.4.0
Red Hat Hawtio — versions 1.4
Redhat Jboss_fuse — versions 6.3

Weakness classification (CWE)

CWE-285 — Improper Authorization

References

secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Vendor Advisory)
secalert@redhat.com (x_refsource_CONFIRM, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2017-2589?: CVE-2017-2589 is a high-severity vulnerability in Hawt Hawtio, classified under Improper Authorization. CVSS score: 8.7/10. Published 2018-07-26.
How severe is CVE-2017-2589?: High severity. CVSS v3 base score is 8.7 out of 10.