An XSS attack can be performed by manipulating the mimeType query parameter to coerce the Web browser to display the JSON response directly. However, the Jolokia responses are not shown directly in the browser but used by a JavaScript library, which has to perform its own escaping of user provided response data.
External References:
https://jolokia.org/#Securityfixeswith1.5.0
References:
https://snyk.io/vuln/SNYK-JAVA-ORGJOLOKIA-32136