CVE-2018-1000129: XSS
An XSS attack can be performed by manipulating the mimeType query parameter to coerce the Web browser to display the JSON response directly. However, the Jolokia responses are not shown directly in the browser but used by a JavaScript library, which has to perform its own escaping of user provided response data.
External References:
https://jolokia.org/#Securityfixeswith1.5.0
References:
https://snyk.io/vuln/SNYK-JAVA-ORGJOLOKIA-32136
Other sources
An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jolokia-coreto a version that resolves this vulnerability.Fixed in 1.5.0
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1000129?
The severity of CVE-2018-1000129 is medium with a severity value of 6.1.
How can an attacker exploit the vulnerability in CVE-2018-1000129?
An attacker can exploit the vulnerability in CVE-2018-1000129 by executing malicious JavaScript in the victim's browser.
Which software versions are affected by CVE-2018-1000129?
The Jolokia agent version 1.3.7 is affected by CVE-2018-1000129.
How can I fix CVE-2018-1000129?
To fix CVE-2018-1000129, upgrade to Jolokia agent version 1.5.0.
What is the CWE ID for CVE-2018-1000129?
The CWE ID for CVE-2018-1000129 is 79.