Vulnerability-Lookup

CVE-2014-0168 (GCVE-0-2014-0168)

Vulnerability from cvelistv5 – Published: 2014-10-06 14:00 – Updated: 2024-08-06 09:05

Summary

Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for requests that execute MBeans methods via a crafted web page.

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

2 references

URL	Tags
https://github.com/rhuss/jolokia/commit/2d9b168cf…	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2014-1351.html	vendor-advisoryx_refsource_REDHAT

Date Public

2014-04-10 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T09:05:38.929Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/rhuss/jolokia/commit/2d9b168cfbbf5a6d16fa6e8a5b34503e3dc42364"
          },
          {
            "name": "RHSA-2014:1351",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2014-1351.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-04-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for requests that execute MBeans methods via a crafted web page."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-10-06T13:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rhuss/jolokia/commit/2d9b168cfbbf5a6d16fa6e8a5b34503e3dc42364"
        },
        {
          "name": "RHSA-2014:1351",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2014-1351.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2014-0168",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for requests that execute MBeans methods via a crafted web page."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/rhuss/jolokia/commit/2d9b168cfbbf5a6d16fa6e8a5b34503e3dc42364",
              "refsource": "CONFIRM",
              "url": "https://github.com/rhuss/jolokia/commit/2d9b168cfbbf5a6d16fa6e8a5b34503e3dc42364"
            },
            {
              "name": "RHSA-2014:1351",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2014-1351.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2014-0168",
    "datePublished": "2014-10-06T14:00:00.000Z",
    "dateReserved": "2013-12-03T00:00:00.000Z",
    "dateUpdated": "2024-08-06T09:05:38.929Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2014-0168",
      "date": "2026-09-15",
      "epss": "0.00739",
      "percentile": "0.52677"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:jolokia:jolokia:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"1.2.0\", \"matchCriteriaId\": \"99CC3823-8D17-4432-8018-84FC8B98E502\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:jolokia:jolokia:1.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2D03D1F6-AD2D-4A48-8958-DBDF5315876D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:jolokia:jolokia:1.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C71FE521-6CB8-4C4B-B31B-DE2F12CC9272\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:jolokia:jolokia:1.0.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AA487623-F58C-418D-964E-FFE0BBBE0BA1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:jolokia:jolokia:1.0.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BF8F76F1-BDA3-49D3-B061-483D69BF4D9A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:jolokia:jolokia:1.0.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"20353C40-C19A-40C4-BB27-1F21787FDD43\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:jolokia:jolokia:1.0.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4DC40D59-D3FF-4988-BC25-2D2533883F9F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:jolokia:jolokia:1.0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E3466BB2-38EF-4F0A-AEC3-BA73A070E2D0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:jolokia:jolokia:1.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3790CA6F-E5FA-4E8C-952F-A36D0F5976B4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:jolokia:jolokia:1.1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"541C4C97-DE34-42D9-A726-D85351559848\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:jolokia:jolokia:1.1.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"598A6467-40D9-489B-8A14-633729A757E9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:jolokia:jolokia:1.1.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E016BE8B-191C-452A-AA7F-C2C4086AECBA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:jolokia:jolokia:1.1.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DF5DF788-9FBD-4FD9-927A-0BC23D123C3E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:jolokia:jolokia:1.1.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"92C4130E-0111-4FF3-8B1D-54ACB9A44503\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for requests that execute MBeans methods via a crafted web page.\"}, {\"lang\": \"es\", \"value\": \"Vulnerabilidad de CSRF en Jolokia anterior a 1.2.1 permite a atacantes remotos secuestrar la autenticaci\\u00f3n de usuarios para solicitudes que ejecutan m\\u00e9todos MBeans a trav\\u00e9s de una p\\u00e1gina web manipulada.\"}]",
      "id": "CVE-2014-0168",
      "lastModified": "2024-11-21T02:01:32.430",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:P/I:P/A:P\", \"baseScore\": 6.8, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2014-10-06T14:55:08.250",
      "references": "[{\"url\": \"http://rhn.redhat.com/errata/RHSA-2014-1351.html\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://github.com/rhuss/jolokia/commit/2d9b168cfbbf5a6d16fa6e8a5b34503e3dc42364\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Exploit\"]}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2014-1351.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://github.com/rhuss/jolokia/commit/2d9b168cfbbf5a6d16fa6e8a5b34503e3dc42364\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\"]}]",
      "sourceIdentifier": "secalert@redhat.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-352\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2014-0168\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2014-10-06T14:55:08.250\",\"lastModified\":\"2026-05-06T22:30:45.220\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for requests that execute MBeans methods via a crafted web page.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de CSRF en Jolokia anterior a 1.2.1 permite a atacantes remotos secuestrar la autenticaci\u00f3n de usuarios para solicitudes que ejecutan m\u00e9todos MBeans a trav\u00e9s de una p\u00e1gina web manipulada.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"baseScore\":6.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-352\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jolokia:jolokia:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.2.0\",\"matchCriteriaId\":\"99CC3823-8D17-4432-8018-84FC8B98E502\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jolokia:jolokia:1.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D03D1F6-AD2D-4A48-8958-DBDF5315876D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jolokia:jolokia:1.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C71FE521-6CB8-4C4B-B31B-DE2F12CC9272\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jolokia:jolokia:1.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AA487623-F58C-418D-964E-FFE0BBBE0BA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jolokia:jolokia:1.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BF8F76F1-BDA3-49D3-B061-483D69BF4D9A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jolokia:jolokia:1.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"20353C40-C19A-40C4-BB27-1F21787FDD43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jolokia:jolokia:1.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DC40D59-D3FF-4988-BC25-2D2533883F9F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jolokia:jolokia:1.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E3466BB2-38EF-4F0A-AEC3-BA73A070E2D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jolokia:jolokia:1.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3790CA6F-E5FA-4E8C-952F-A36D0F5976B4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jolokia:jolokia:1.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"541C4C97-DE34-42D9-A726-D85351559848\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jolokia:jolokia:1.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"598A6467-40D9-489B-8A14-633729A757E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jolokia:jolokia:1.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E016BE8B-191C-452A-AA7F-C2C4086AECBA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jolokia:jolokia:1.1.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF5DF788-9FBD-4FD9-927A-0BC23D123C3E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jolokia:jolokia:1.1.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"92C4130E-0111-4FF3-8B1D-54ACB9A44503\"}]}]}],\"references\":[{\"url\":\"http://rhn.redhat.com/errata/RHSA-2014-1351.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/rhuss/jolokia/commit/2d9b168cfbbf5a6d16fa6e8a5b34503e3dc42364\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Exploit\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2014-1351.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/rhuss/jolokia/commit/2d9b168cfbbf5a6d16fa6e8a5b34503e3dc42364\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\"]}]}}"
  }
}

FKIE_CVE-2014-0168

Vulnerability from fkie_nvd - Published: 2014-10-06 14:55 - Updated: 2026-06-17 00:02

Severity

Summary

Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for requests that execute MBeans methods via a crafted web page.

References

URL	Tags
secalert@redhat.com	http://rhn.redhat.com/errata/RHSA-2014-1351.html	Vendor Advisory
secalert@redhat.com	https://github.com/rhuss/jolokia/commit/2d9b168cfbbf5a6d16fa6e8a5b34503e3dc42364	Exploit
af854a3a-2127-422b-91ae-364da2661108	http://rhn.redhat.com/errata/RHSA-2014-1351.html	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/rhuss/jolokia/commit/2d9b168cfbbf5a6d16fa6e8a5b34503e3dc42364	Exploit

Impacted products

Vendor	Product	Version
jolokia	jolokia	*
jolokia	jolokia	1.0.0
jolokia	jolokia	1.0.1
jolokia	jolokia	1.0.2
jolokia	jolokia	1.0.3
jolokia	jolokia	1.0.4
jolokia	jolokia	1.0.5
jolokia	jolokia	1.0.6
jolokia	jolokia	1.1.0
jolokia	jolokia	1.1.1
jolokia	jolokia	1.1.2
jolokia	jolokia	1.1.3
jolokia	jolokia	1.1.4
jolokia	jolokia	1.1.5

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:jolokia:jolokia:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "99CC3823-8D17-4432-8018-84FC8B98E502",
              "versionEndIncluding": "1.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:jolokia:jolokia:1.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "2D03D1F6-AD2D-4A48-8958-DBDF5315876D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:jolokia:jolokia:1.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C71FE521-6CB8-4C4B-B31B-DE2F12CC9272",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:jolokia:jolokia:1.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "AA487623-F58C-418D-964E-FFE0BBBE0BA1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:jolokia:jolokia:1.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "BF8F76F1-BDA3-49D3-B061-483D69BF4D9A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:jolokia:jolokia:1.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "20353C40-C19A-40C4-BB27-1F21787FDD43",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:jolokia:jolokia:1.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "4DC40D59-D3FF-4988-BC25-2D2533883F9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:jolokia:jolokia:1.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "E3466BB2-38EF-4F0A-AEC3-BA73A070E2D0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:jolokia:jolokia:1.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "3790CA6F-E5FA-4E8C-952F-A36D0F5976B4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:jolokia:jolokia:1.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "541C4C97-DE34-42D9-A726-D85351559848",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:jolokia:jolokia:1.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "598A6467-40D9-489B-8A14-633729A757E9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:jolokia:jolokia:1.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "E016BE8B-191C-452A-AA7F-C2C4086AECBA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:jolokia:jolokia:1.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "DF5DF788-9FBD-4FD9-927A-0BC23D123C3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:jolokia:jolokia:1.1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "92C4130E-0111-4FF3-8B1D-54ACB9A44503",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for requests that execute MBeans methods via a crafted web page."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de CSRF en Jolokia anterior a 1.2.1 permite a atacantes remotos secuestrar la autenticaci\u00f3n de usuarios para solicitudes que ejecutan m\u00e9todos MBeans a trav\u00e9s de una p\u00e1gina web manipulada."
    }
  ],
  "id": "CVE-2014-0168",
  "lastModified": "2026-06-17T00:02:25.727",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2014-10-06T14:55:08.250",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2014-1351.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Exploit"
      ],
      "url": "https://github.com/rhuss/jolokia/commit/2d9b168cfbbf5a6d16fa6e8a5b34503e3dc42364"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2014-1351.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "https://github.com/rhuss/jolokia/commit/2d9b168cfbbf5a6d16fa6e8a5b34503e3dc42364"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-FJHW-8222-G2HG

Vulnerability from github – Published: 2022-05-17 04:31 – Updated: 2022-07-07 22:59

Summary

Cross-Site Request Forgery in Jolokia

Details

Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for requests that execute MBeans methods via a crafted web page.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.jolokia:jolokia-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2014-0168"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-07T22:59:28Z",
    "nvd_published_at": "2014-10-06T14:55:00Z",
    "severity": "MODERATE"
  },
  "details": "Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for requests that execute MBeans methods via a crafted web page.",
  "id": "GHSA-fjhw-8222-g2hg",
  "modified": "2022-07-07T22:59:28Z",
  "published": "2022-05-17T04:31:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0168"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rhuss/jolokia/commit/2d9b168cfbbf5a6d16fa6e8a5b34503e3dc42364"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-1351.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Cross-Site Request Forgery in Jolokia"
}

GSD-2014-0168

Vulnerability from gsd - Updated: 2023-12-13 01:22

Details

Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for requests that execute MBeans methods via a crafted web page.

Aliases

CVE-2014-0168

Aliases

CVE-2014-0168

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2014-0168",
    "description": "Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for requests that execute MBeans methods via a crafted web page.",
    "id": "GSD-2014-0168",
    "references": [
      "https://access.redhat.com/errata/RHSA-2014:1351"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2014-0168"
      ],
      "details": "Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for requests that execute MBeans methods via a crafted web page.",
      "id": "GSD-2014-0168",
      "modified": "2023-12-13T01:22:44.096611Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secalert@redhat.com",
        "ID": "CVE-2014-0168",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for requests that execute MBeans methods via a crafted web page."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/rhuss/jolokia/commit/2d9b168cfbbf5a6d16fa6e8a5b34503e3dc42364",
            "refsource": "CONFIRM",
            "url": "https://github.com/rhuss/jolokia/commit/2d9b168cfbbf5a6d16fa6e8a5b34503e3dc42364"
          },
          {
            "name": "RHSA-2014:1351",
            "refsource": "REDHAT",
            "url": "http://rhn.redhat.com/errata/RHSA-2014-1351.html"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "(,1.2.1)",
          "affected_versions": "All versions before 1.2.1",
          "cvss_v2": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "cwe_ids": [
            "CWE-1035",
            "CWE-352",
            "CWE-352",
            "CWE-937"
          ],
          "date": "2022-07-07",
          "description": "Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for requests that execute MBeans methods via a crafted web page.",
          "fixed_versions": [
            "1.2.1"
          ],
          "identifier": "CVE-2014-0168",
          "identifiers": [
            "GHSA-fjhw-8222-g2hg",
            "CVE-2014-0168"
          ],
          "not_impacted": "All versions starting from 1.2.1",
          "package_slug": "maven/org.jolokia/jolokia-core",
          "pubdate": "2022-05-17",
          "solution": "Upgrade to version 1.2.1 or above.",
          "title": "Cross-Site Request Forgery (CSRF)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2014-0168",
            "https://github.com/rhuss/jolokia/commit/2d9b168cfbbf5a6d16fa6e8a5b34503e3dc42364",
            "http://rhn.redhat.com/errata/RHSA-2014-1351.html",
            "https://github.com/advisories/GHSA-fjhw-8222-g2hg"
          ],
          "uuid": "3c177264-8984-4978-b970-585616665980"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:jolokia:jolokia:1.0.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:jolokia:jolokia:1.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:jolokia:jolokia:1.0.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:jolokia:jolokia:1.1.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:jolokia:jolokia:1.1.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:jolokia:jolokia:1.0.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:jolokia:jolokia:1.0.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:jolokia:jolokia:1.1.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:jolokia:jolokia:1.1.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:jolokia:jolokia:1.1.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:jolokia:jolokia:1.1.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:jolokia:jolokia:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "1.2.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:jolokia:jolokia:1.0.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:jolokia:jolokia:1.0.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2014-0168"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for requests that execute MBeans methods via a crafted web page."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-352"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2014:1351",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://rhn.redhat.com/errata/RHSA-2014-1351.html"
            },
            {
              "name": "https://github.com/rhuss/jolokia/commit/2d9b168cfbbf5a6d16fa6e8a5b34503e3dc42364",
              "refsource": "CONFIRM",
              "tags": [
                "Exploit"
              ],
              "url": "https://github.com/rhuss/jolokia/commit/2d9b168cfbbf5a6d16fa6e8a5b34503e3dc42364"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        }
      },
      "lastModifiedDate": "2014-10-07T15:20Z",
      "publishedDate": "2014-10-06T14:55Z"
    }
  }
}

RHSA-2014:1351

Vulnerability from csaf_redhat - Published: 2014-10-01 18:10 - Updated: 2026-08-04 22:01

Summary

Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.1.0 security update

Severity

Important

Scope

8 vulnerabilities in this advisory.

Open the full advisory

RHSA-2014_1351

Vulnerability from csaf_redhat - Published: 2014-10-01 18:10 - Updated: 2024-11-25 11:57

Summary

Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.1.0 security update

Severity

Important

Scope

9 vulnerabilities in this advisory, including CVE-2014-0168.

CVE-2014-0168

It was found that Jolokia was vulnerable to Cross-Site Request Forgery (CSRF) attacks. A remote attacker could provide a specially crafted web page that, when visited by a user logged in to Jolokia, could allow the attacker to execute arbitrary methods on MBeans exposed via JMX.

4.3 ()


                
                  AV:N/AC:M/Au:N/C:N/I:P/A:N

Fixed: 2 products

https://access.redhat.com/errata/RHSA-2014:1351

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2014-0168 (GCVE-0-2014-0168)

FKIE_CVE-2014-0168

GHSA-FJHW-8222-G2HG

GSD-2014-0168

RHSA-2014:1351

RHSA-2014_1351

Tags

Sightings

Nomenclature