GCVE - cpe:2.3:a:hawt:hawtio:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:hawt:hawtio:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Hawt (`3b9fdc64-d0e8-5f8f-ad73-d60dfb0b0a62`)
Product	Hawtio (`7f35089a-906b-5e94-99d7-0ba096bc1054`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/hawtio/hawtio`	purl2cpe	2026-06-01 10:15:26.402139

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2019-9827`	vulnerable	2026-06-08 05:14:26.273691	Details available Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI. Published: 2019-07-03T20:13:06.000Z Updated: 2024-08-04T22:01:54.883Z Open on db.gcve.eu Reference links https://www.ciphertechs.com/hawtio-advisory/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-2617`	vulnerable	2026-06-08 05:09:24.779429	Details available HIGH (7.6) hawtio before version 1.5.5 is vulnerable to remote code execution via file upload. An attacker could use this vulnerability to upload a crafted file which could be executed on a target machine where hawtio is deployed. Published: 2018-05-22T17:00:00.000Z Updated: 2024-08-05T14:02:06.951Z Open on db.gcve.eu Reference links https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2617 https://access.redhat.com/errata/RHSA-2018:0319 http://www.securityfocus.com/bid/96036	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-2594`	vulnerable	2026-06-08 05:09:24.713258	Details available MEDIUM (5.4) hawtio before versions 2.0-beta-1, 2.0-beta-2 2.0-m1, 2.0-m2, 2.0-m3, and 1.5 is vulnerable to a path traversal that leads to a NullPointerException with a full stacktrace. An attacker could use this flaw to gather undisclosed information from within hawtio's root. Published: 2018-05-08T17:00:00.000Z Updated: 2024-08-05T14:02:06.485Z Open on db.gcve.eu Reference links https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2594 https://access.redhat.com/errata/RHSA-2017:1832 http://www.securityfocus.com/bid/95793	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-0121`	vulnerable	2026-06-08 05:05:11.616144	Details available The admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary commands via the k parameter. Published: 2017-12-29T22:00:00.000Z Updated: 2024-08-06T09:05:38.810Z Open on db.gcve.eu Reference links https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdf https://github.com/hawtio/hawtio/commit/5289715e4f2657562fdddcbad830a30969b96e1e https://bugzilla.redhat.com/show_bug.cgi?id=1072716	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-0120`	vulnerable	2026-06-08 05:05:11.614803	Details available Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arbitrary users for requests that run commands on the Karaf server, as demonstrated by running "shutdown -f." Published: 2017-12-29T22:00:00.000Z Updated: 2024-08-06T09:05:38.398Z Open on db.gcve.eu Reference links https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdf https://github.com/hawtio/hawtio/commit/b4e23e002639c274a2f687ada980118512f06113 https://bugzilla.redhat.com/show_bug.cgi?id=1072681	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Hawtio

Notes

PURL mappings

Vulnerability references

Contribute