CVE-2017-2617CWE-20

hawtio before version 1.5.5 is vulnerable to remote code execution via file upload

High · published May 22, 2018

CVSS v3.0
7.6
EPSS
2%
Percentile
76.7
In the wild
Unconfirmed
What it is

hawtio before version 1.5.5 is vulnerable to remote code execution via file upload. An attacker could use this vulnerability to upload a crafted file which could be executed on a target machine where hawtio is deployed.

The record
Technical detail
CVSS v3.0
7.6 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.01684 · 76.7th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2018-05-22T17:00Z
EPSS history
Timeline
  • 22 MAY 17:00Z
    hawtio before version 1.5.5 is vulnerable to remote code execution via file upload
    cvelistv5