CVE-2017-2594

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

hawtio before versions 2.0-beta-1, 2.0-beta-2 2.0-m1, 2.0-m2, 2.0-m3, and 1.5 is vulnerable to a path traversal that leads to a NullPointerException with a full stacktrace. An attacker could use this flaw to gather undisclosed information from within hawtio's root.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-209 CWE-22

Affected software

Vendor	Product	Versions
unspecified	hawtio	hawtio 2.0-beta-1; hawtio 2.0-beta-2 hawtio 2.0-M1; hawtio 2.0-M2; hawtio 2.0-M3; hawtio 1.5

References

http://www.securityfocus.com/bid/95793Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:1832Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2594Issue Tracking, Third Party Advisory
http://www.securityfocus.com/bid/95793Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:1832Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2594Issue Tracking, Third Party Advisory

Timeline

Published: May 8, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-25956.5It was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows arbitrary file read to authenticated user via p CVE-2017-25966.5The nested_vmx_check_vmptr function in arch/x86/kvm/vmx.c in the Linux kernel through 4.9.8 improperly emulates the VMXON instruction, which CVE-2017-25984.3Jenkins before versions 2.44, 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored sec CVE-2017-25995.4Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check. This allows users with permissions to create new CVE-2017-26004.3In jenkins before versions 2.44, 2.32.2 node monitor data could be viewed by low privilege users via the remote API. These included system c CVE-2017-26015.4Jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in parameter names and descriptions (SECURITY-353). U CVE-2017-26024.3jenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the agent-to-master securit CVE-2017-26033.5Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive dat CVE-2017-26044.3In Jenkins before versions 2.44, 2.32.2 low privilege users were able to act on administrative monitors due to them not being consistently p CVE-2017-26064.3Jenkins before versions 2.44, 2.32.2 is vulnerable to an information exposure in the internal API that allows access to item names that shou CVE-2017-26075.4jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (SECURITY-382). Jenkin CVE-2017-26088.8Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types i