CVE-2018-1000129

MEDIUM6.1EPSS 76.8%

Cross-site Scripting in Jolokia agent

發布日:2022/5/14修改日:2023/11/8

描述

An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.

受影響套件(1)

Maven/org.jolokia:jolokia-core>= 1.3.7, < 1.5.0

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM6.1	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

參考連結(7)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2018-1000129
PATCHhttps://github.com/rhuss/jolokia
WEBhttps://access.redhat.com/errata/RHSA-2018:2669
WEBhttps://access.redhat.com/errata/RHSA-2018:3817
WEBhttps://github.com/rhuss/jolokia/commit/5895d5c137c335e6b473e9dcb9baf748851bbc5f#diff-f19898247eddb55de6400489bff748ad
WEBhttps://github.com/rhuss/jolokia/releases/tag/v1.5.0
WEBhttps://jolokia.org/#Security_fixes_with_1.5.0