Vulnerabilities > CVE-2019-9827 - Server-Side Request Forgery (SSRF) vulnerability in Hawt Hawtio

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

hawt

CWE-918

critical

NVD

Published: 2019-07-03

Updated: 2024-11-21

Summary

Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI.

Vulnerable Configurations

Part	Description	Count
Application	Hawt Hawt Hawtio 0.1 Hawt Hawtio 1.0 Hawt Hawtio 1.1 Hawt Hawtio 1.2.0 Hawt Hawtio 1.2.1 Hawt Hawtio 1.2.2 Hawt Hawtio 1.2.3 Hawt Hawtio 1.3.0 Hawt Hawtio 1.3.1 Hawt Hawtio 1.4.0 Hawt Hawtio 1.4.1 Hawt Hawtio 1.4.2 Hawt Hawtio 1.4.3 Hawt Hawtio 1.4.4 Hawt Hawtio 1.4.5 Hawt Hawtio 1.4.6 Hawt Hawtio 1.4.7 Hawt Hawtio 1.4.8 Hawt Hawtio 1.4.9 Hawt Hawtio 1.4.10 Hawt Hawtio 1.4.11 Hawt Hawtio 1.4.12 Hawt Hawtio 1.4.14 Hawt Hawtio 1.4.15 Hawt Hawtio 1.4.16 Hawt Hawtio 1.4.17 Hawt Hawtio 1.4.18 Hawt Hawtio 1.4.19 Hawt Hawtio 1.4.20 Hawt Hawtio 1.4.21 Hawt Hawtio 1.4.22 Hawt Hawtio 1.4.23 Hawt Hawtio 1.4.24 Hawt Hawtio 1.4.25 Hawt Hawtio 1.4.26 Hawt Hawtio 1.4.27 Hawt Hawtio 1.4.28 Hawt Hawtio 1.4.29 Hawt Hawtio 1.4.30 Hawt Hawtio 1.4.31 Hawt Hawtio 1.4.32 Hawt Hawtio 1.4.33 Hawt Hawtio 1.4.34 Hawt Hawtio 1.4.35 Hawt Hawtio 1.4.36 Hawt Hawtio 1.4.37 Hawt Hawtio 1.4.38 Hawt Hawtio 1.4.39 Hawt Hawtio 1.4.40 Hawt Hawtio 1.4.41 Hawt Hawtio 1.4.42 Hawt Hawtio 1.4.43 Hawt Hawtio 1.4.44 Hawt Hawtio 1.4.45 Hawt Hawtio 1.4.46 Hawt Hawtio 1.4.47 Hawt Hawtio 1.4.48 Hawt Hawtio 1.4.49 Hawt Hawtio 1.4.50 Hawt Hawtio 1.4.51 Hawt Hawtio 1.4.52 Hawt Hawtio 1.4.53 Hawt Hawtio 1.4.54 Hawt Hawtio 1.4.55 Hawt Hawtio 1.4.56 Hawt Hawtio 1.4.57 Hawt Hawtio 1.4.58 Hawt Hawtio 1.4.59 Hawt Hawtio 1.4.60 Hawt Hawtio 1.4.61 Hawt Hawtio 1.4.62 Hawt Hawtio 1.4.63 Hawt Hawtio 1.4.64 Hawt Hawtio 1.4.65 Hawt Hawtio 1.4.66 Hawt Hawtio 1.4.67 Hawt Hawtio 1.4.68 Hawt Hawtio 1.5.0 Hawt Hawtio 1.5.1 Hawt Hawtio 1.5.2 Hawt Hawtio 1.5.3 Hawt Hawtio 1.5.4 Hawt Hawtio 1.5.5 Hawt Hawtio 1.5.6 Hawt Hawtio 1.5.7 Hawt Hawtio 1.5.8 Hawt Hawtio 1.5.9 Hawt Hawtio 1.5.10 Hawt Hawtio 1.5.11 Hawt Hawtio 1.5.12 Hawt Hawtio 2.0.1 Hawt Hawtio 2.0.2 Hawt Hawtio 2.0.3 Hawt Hawtio 2.1.0 Hawt Hawtio 2.2.0 Hawt Hawtio 2.3.0 Hawt Hawtio 2.4.0 Hawt Hawtio 2.5.0	98

Common Weakness Enumeration (CWE)

CWE-918 - Server-Side Request Forgery (SSRF)

Packetstorm

data source	https://packetstormsecurity.com/files/download/153524/ciphertechs-hawtio.txt
id	PACKETSTORM:153524
last seen	2019-07-05
published	2019-07-03
reporter	CipherTechs
source	https://packetstormsecurity.com/files/153524/Hawtio-2.5.0-Server-Side-Request-Forgery.html
title	Hawtio 2.5.0 Server Side Request Forgery

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Packetstorm

References