CVE-2017-2589

CriticalCVSS 9.0/10Last modified Jun 17, 2026

Description

It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.

Metrics

CVSS 3.0 9.0/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-285

Affected software

Vendor	Product	Versions
Red Hat	hawtio	1.4

References

https://access.redhat.com/errata/RHSA-2017:1832Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2589Issue Tracking, Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:1832Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2589Issue Tracking, Vendor Advisory

Timeline

Published: Jul 26, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-25908.1A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions CVE-2017-25917.5389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config() function in the "a CVE-2017-25925.5python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class CVE-2017-25947.5hawtio before versions 2.0-beta-1, 2.0-beta-2 2.0-m1, 2.0-m2, 2.0-m3, and 1.5 is vulnerable to a path traversal that leads to a NullPointerE CVE-2017-25956.5It was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows arbitrary file read to authenticated user via p CVE-2017-25966.5The nested_vmx_check_vmptr function in arch/x86/kvm/vmx.c in the Linux kernel through 4.9.8 improperly emulates the VMXON instruction, which CVE-2017-25984.3Jenkins before versions 2.44, 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored sec CVE-2017-25995.4Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check. This allows users with permissions to create new CVE-2017-26004.3In jenkins before versions 2.44, 2.32.2 node monitor data could be viewed by low privilege users via the remote API. These included system c CVE-2017-26015.4Jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in parameter names and descriptions (SECURITY-353). U CVE-2017-26024.3jenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the agent-to-master securit CVE-2017-26033.5Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive dat