CVE-2017-2594: Path Traversal
hawtio before versions 2.0-beta-1, 2.0-beta-2 2.0-m1, 2.0-m2, 2.0-m3, and 1.5 is vulnerable to a path traversal that leads to a NullPointerException with a full stacktrace. An attacker could use this flaw to gather undisclosed information from within hawtio's root.
Other sources
It was found that a path traversal vulnerability in hawtio leads to a NullPointerException with a full stacktrace. An attacker can use this flaw to gather undisclosed information from withinhawtio's root.
— Red Hat
It was found that a path traversal vulnerability in hawtio leads to a NullPointerException with a full stacktrace. An attacker could use this flaw to gather undisclosed information from within hawtio's root.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-2594?
CVE-2017-2594 is classified as a medium severity vulnerability due to its potential to expose sensitive information through a path traversal attack.
How do I fix CVE-2017-2594?
To fix CVE-2017-2594, upgrade to a version of Hawtio later than 1.4.68 that is not affected by this vulnerability.
What type of vulnerability is CVE-2017-2594?
CVE-2017-2594 is a path traversal vulnerability that allows attackers to manipulate file paths within the application.
What can an attacker do with CVE-2017-2594?
An attacker exploiting CVE-2017-2594 could potentially obtain undisclosed information from the root of Hawtio.
Which versions of Hawtio are affected by CVE-2017-2594?
CVE-2017-2594 affects Hawtio versions prior to 2.0-beta-1, 2.0-beta-2, 2.0-m1, 2.0-m2, 2.0-m3, and up to 1.4.68.