What is GHSA-rhqj-4pp8-vvgf?

GHSA-rhqj-4pp8-vvgf is a security advisory published by GitHub Security Advisories with High severity. Injection in Jolokia agent

Which CVE IDs does GHSA-rhqj-4pp8-vvgf cover?

GHSA-rhqj-4pp8-vvgf covers the following CVE IDs: CVE-2018-1000130. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rhqj-4pp8-vvgf?

GHSA-rhqj-4pp8-vvgf has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

Which products are affected by GHSA-rhqj-4pp8-vvgf?

GHSA-rhqj-4pp8-vvgf affects 1 product, including: maven/org.jolokia:jolokia-core:\u003e= 1.3.7, \u003c 1.5.0.

GHSA-rhqj-4pp8-vvgfHighCVSS 8.1

Injection in Jolokia agent

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2018-1000130 →

📋 Description

A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to run arbitrary Java code on the server.

🎯 Affected products1

maven/org.jolokia:jolokia-core:>= 1.3.7, < 1.5.0

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2018-1000130
https://access.redhat.com/errata/RHSA-2018:2669
https://jolokia.org/#Security_fixes_with_1.5.0
https://github.com/rhuss/jolokia/commit/1b360b8889f0ed51165a8d1ac55dd8e0aa2dfd4a
https://github.com/rhuss/jolokia/commit/fd7b93da30c61a45bac10d8b311f1b79a74910f5
https://github.com/rhuss/jolokia/releases/tag/v1.5.0
https://github.com/advisories/GHSA-rhqj-4pp8-vvgf