CVE-2017-2594 — hawtio: information Disclosure flaws due to unsafe path traversal

Back Back to CVE browser

HIGH

hawtio: information Disclosure flaws due to unsafe path traversal

Published May 8, 2018

7.5

HIGH

CVSS 3.0

EPSS 1.88%

Description

hawtio before versions 2.0-beta-1, 2.0-beta-2 2.0-m1, 2.0-m2, 2.0-m3, and 1.5 is vulnerable to a path traversal that leads to a NullPointerException with a full stacktrace. An attacker could use this flaw to gather undisclosed information from within hawtio's root.

Affected products

Vendor n/a Product Hawtio Default
n/a
- Version
  hawtio 1.5
  Status
  affected
  Constraints
  -
- Version
  hawtio 2.0-M2
  Status
  affected
  Constraints
  -
- Version
  hawtio 2.0-M3
  Status
  affected
  Constraints
  -
- Version
  hawtio 2.0-beta-1
  Status
  affected
  Constraints
  -
- Version
  hawtio 2.0-beta-2 hawtio 2.0-M1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Hawtio

n/a

Version	Status	Constraints
hawtio 1.5	affected	-
hawtio 2.0-M2	affected	-
hawtio 2.0-M3	affected	-
hawtio 2.0-beta-1	affected	-
hawtio 2.0-beta-2 hawtio 2.0-M1	affected	-

Red Hat JBoss A-MQ 6.3

n/a

Fixed · RHSA-2017:1832
Red Hat JBoss Fuse 6.3

n/a

Fixed · RHSA-2017:1832
Red Hat JBoss A-MQ 6

hawtio

Out of support scope
Red Hat JBoss Fuse 6

hawtio

Out of support scope
Red Hat OpenShift Enterprise 2

hawtio

Will not fix

Product	Package	State	Advisory
Red Hat JBoss A-MQ 6.3	n/a	Fixed	RHSA-2017:1832
Red Hat JBoss Fuse 6.3	n/a	Fixed	RHSA-2017:1832
Red Hat JBoss A-MQ 6	hawtio	Out of support scope	n/a
Red Hat JBoss Fuse 6	hawtio	Out of support scope	n/a
Red Hat OpenShift Enterprise 2	hawtio	Will not fix	n/a

Remediation

No remediation recorded yet.

Metrics

1.88% 0.01885

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01885

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (23 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.88% (0.01885)	78.75th	v5 (v2026.06.15)
Jun 15, 2026	1.96% (0.01955)	77.59th	v5 (v2026.06.15)
Mar 17, 2025	2.15% (0.02152)	83.08th	v4 (v2025.03.14)
Jul 20, 2024	0.17% (0.00169)	54.20th	v3 (v2023.03.01)
Feb 21, 2024	0.17% (0.00169)	52.70th	v3 (v2023.03.01)
Dec 26, 2023	0.20% (0.00201)	58.02th	v3 (v2023.03.01)
Sep 29, 2023	0.24% (0.00244)	61.98th	v3 (v2023.03.01)
Sep 7, 2023	0.50% (0.00497)	73.32th	v3 (v2023.03.01)
Jul 31, 2023	0.34% (0.00338)	67.50th	v3 (v2023.03.01)
Jul 8, 2023	0.29% (0.00289)	64.65th	v3 (v2023.03.01)
Jun 6, 2023	0.46% (0.00458)	71.73th	v3 (v2023.03.01)
May 8, 2023	0.46% (0.00465)	71.77th	v3 (v2023.03.01)
May 2, 2023	0.29% (0.00294)	64.57th	v3 (v2023.03.01)
Apr 17, 2023	0.32% (0.00319)	65.99th	v3 (v2023.03.01)
Mar 7, 2023	0.31% (0.00313)	65.42th	v3 (v2023.03.01)
Mar 6, 2023	0.95% (0.00954)	36.37th	v2 (v2022.01.01)
Sep 2, 2022	0.95% (0.00954)	34.50th	v2 (v2022.01.01)
Apr 1, 2022	0.95% (0.00954)	32.50th	v2 (v2022.01.01)
Feb 4, 2022	0.95% (0.00954)	16.28th	v2 (v2022.01.01)
Feb 3, 2022	0.83% (0.00833)	24.58th	v1
Jan 6, 2022	0.83% (0.00833)	23.96th	v1
Sep 1, 2021	0.83% (0.00833)	57.50th	v1
Apr 14, 2021	0.83% (0.00833)	0.00th	v1

Weaknesses (2)

CWE-209

CWE-22

Path Traversal

References (8)

http://www.securityfocus.com/bid/95793
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2017:1832
x_refsource_CONFIRMThird Party Advisory
https://access.redhat.com/security/cve/CVE-2017-2594
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1415543
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2594
x_refsource_CONFIRMIssue TrackingThird Party Advisory
https://github.com/advisories/GHSA-9g8w-pjpr-prr4
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-2594
https://www.cve.org/CVERecord?id=CVE-2017-2594

Link	Providers	Tags
http://www.securityfocus.com/bid/95793		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2017:1832		x_refsource_CONFIRMThird Party Advisory
https://access.redhat.com/security/cve/CVE-2017-2594		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1415543		Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2594		x_refsource_CONFIRMIssue TrackingThird Party Advisory
https://github.com/advisories/GHSA-9g8w-pjpr-prr4		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-2594
https://www.cve.org/CVERecord?id=CVE-2017-2594