CVE-2018-10899 Cross-Site Request Forgery in Jolokia
A CSRF vulnerability in Jolokia allows attackers to trigger remote code execution even with strict origin checks enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-10899?
CVE-2018-10899 is a high-severity vulnerability in Redhat Openstack, published on 1 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured instances with strict checking for origin and referrer headers. This could result in a Remote Code Execution attack.
Which versions are affected by CVE-2018-10899?
2 open source packages ship an affected version, including org.jolokia:jolokia-core. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.jolokia:jolokia-core Maven | From 1.2 | 1.6.1 |
org.jolokia:jolokia-core Maven | From 1.2 | 1.6.1 |
Products include Jolokia Jolokia, Redhat Openstack.
How do I fix CVE-2018-10899?
Upgrade org.jolokia:jolokia-core to 1.6.1 or later.
Is CVE-2018-10899 being exploited?
There is no known exploitation of CVE-2018-10899 in the wild and no public exploit code.
Other vulnerabilities in Redhat Openstack
Sources
Also known as GHSA-xcxf-7q4p-cj26.