Vulnerability Details : CVE-2017-2589
It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.
Vulnerability category: BypassGain privilege
Exploit prediction scoring system (EPSS) score for CVE-2017-2589
Probability of exploitation activity in the next 30 days: 0.09%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 37 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2017-2589
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
6.0
|
MEDIUM | AV:N/AC:M/Au:S/C:P/I:P/A:P |
6.8
|
6.4
|
NIST |
|
9.0
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
2.3
|
6.0
|
NIST |
|
8.7
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N |
2.3
|
5.8
|
Red Hat, Inc. |
CWE ids for CVE-2017-2589
-
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.Assigned by: secalert@redhat.com (Secondary)
References for CVE-2017-2589
-
https://access.redhat.com/errata/RHSA-2017:1832
RHSA-2017:1832 - Security Advisory - Red Hat Customer PortalVendor Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2589
1413905 – (CVE-2017-2589) CVE-2017-2589 hawtio: Proxy is sharing cookies among all the clientsIssue Tracking;Vendor Advisory
Products affected by CVE-2017-2589
- cpe:2.3:a:redhat:jboss_fuse:6.3:*:*:*:*:*:*:*
- cpe:2.3:a:hawt:hawtio:1.4.0:*:*:*:*:*:*:*