What’s Vulnerable › Vulnerabilities

CVE-2017-2589

• Severity: critical (CVSS 9.0 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-07-26 · updated 2026-06-17
• Weakness: CWE-285

Description

It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.

Affected products

• [UNKNOWN] hawtio: 1.4.0
• RedHat Jboss Fuse: 6.3

References

• https://access.redhat.com/errata/RHSA-2017:1832
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2589
• https://access.redhat.com/errata/RHSA-2017:1832
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2589

Get alerted when CVE-2017-2589 or the next vulnerability affects your stack