CVE-2017-7556

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their website containing a malicious script which can be submitted to hawtio server on behalf of the user.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Red Hat, Inc.	hawtio	up to and including 1.5.3

References

http://www.securityfocus.com/bid/100411Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1480060Issue Tracking, Third Party Advisory
http://www.securityfocus.com/bid/100411Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1480060Issue Tracking, Third Party Advisory

Timeline

Published: Aug 17, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-75578.8dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.CVE-2017-75587.5A kernel data leak due to an out-of-bound read was found in the Linux kernel in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() f CVE-2017-75596.1In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666 w CVE-2017-75605.5It was found that rhnsd PID files are created as world-writable that allows local attackers to fill the disks or to kill selected processes.CVE-2017-75617.5Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS com CVE-2017-75626.5An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates. A CVE-2017-75638.1In ARM Trusted Firmware 1.3, RO memory is always executable at AArch64 Secure EL1, allowing attackers to bypass the MT_EXECUTE_NEVER protect CVE-2017-75647.5In ARM Trusted Firmware through 1.3, the secure self-hosted invasive debug interface allows normal world attackers to cause a denial of serv CVE-2017-75658.8Splunk Hadoop Connect App has a path traversal vulnerability that allows remote authenticated users to execute arbitrary code, aka ERP-2041.CVE-2017-75667.7MyBB before 1.8.11 allows remote attackers to bypass an SSRF protection mechanism.CVE-2017-75685.3NetApp OnCommand Unified Manager for 7-Mode (core package) versions prior to 5.2.3 may disclose sensitive LDAP account information to authen CVE-2017-75698.6In vBulletin before 5.3.0, remote attackers can bypass the CVE-2016-6483 patch and conduct SSRF attacks by leveraging the behavior of the PH