CVE-2018-1000129

EPSS 25.5%

Vexday Risk Score

23Bajo

Decisión SSVC (CISA)

Attend

PoC disponible → seguir de cerca

Madurez del exploit

Exploit funcional

Exploit automatizable disponible (Nuclei/Metasploit).

CVSS —EPSS 25.5%KEV nãoPoC —Nuclei simMetasploit —Patch referenciado

Ciclo de vida

14 mar 2018Publicada en NVD

Recomendación: Planificar corrección próxima — ya existe PoC pública.

An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.

Productos afectados

n/a · n/a

Referencias

https://access.redhat.com/errata/RHSA-2018:2669 https://access.redhat.com/errata/RHSA-2018:3817 https://github.com/rhuss/jolokia/commit/5895d5c137c335e6b473e9dcb9baf748851bbc5f#diff-f19898247eddb55de6400489bff748ad https://jolokia.org/#Security_fixes_with_1.5.0