Cookie Sharing Vulnerability in hawtio Servlet by Red Hat

CVE-2017-2589

What is CVE-2017-2589?

A vulnerability has been identified in the hawtio Servlet 1.4, which allows a persistent cookie store to be shared among all clients utilizing the same proxy. This design flaw implies that all clients relying on this proxy could unwittingly share sensitive session cookies, potentially exposing them to unauthorized access and session hijacking attacks. Consequently, organizations leveraging hawtio Servlet should review their deployment configurations and apply best practices to mitigate the associated risks.

References