GHSA-m4j5-hgqq-5jf2CriticalCVSS 9.0

Insecure cookie sharing in Hawtio

Published
May 13, 2022
Last Modified
February 2, 2023

🔗 CVE IDs covered (1)

📋 Description

It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.

🎯 Affected products1

  • maven/io.hawt:project:< 1.5.0

🔗 References (5)