Cross-site Request Forgery (CSRF) Affecting org.jolokia:jolokia-core package, versions [,1.2.1)

Threat Intelligence

0.18% (56^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-JAVA-ORGJOLOKIA-31213
published 10 Feb 2015
disclosed 6 Oct 2014
credit Unknown

Report a new vulnerability Found a mistake?

Introduced: 6 Oct 2014

CVE-2014-0168 Open this link in a new tab CWE-352 Open this link in a new tab

Overview

org.jolokia:jolokia-core Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for requests that execute MBeans methods via a crafted web page.

References

CVSS Scores

version 3.1

Attack Vector (AV)

Network
Attack Complexity (AC)

Low
Privileges Required (PR)

None
User Interaction (UI)

Required

Scope (S)

Unchanged

Confidentiality (C)

Low
Integrity (I)

Low
Availability (A)

Low