A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to run arbitrary Java code on the server.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a
    remote attacker to run arbitrary Java code on the server. (CVE-2018-1000130)

A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 < 1.5.0 in the proxy mode that allows a remote attacker to run arbitrary Java code on the server.

ID	Name	Product	Family	Severity
418759	SCA: security update for org.jolokia:jolokia-core (GHSA-rhqj-4pp8-vvgf)	Tenable Cloud Security	SCA Checks	high
418759	SCA: security update for org.jolokia:jolokia-core (GHSA-rhqj-4pp8-vvgf)	Tenable Self-Hosted Container Security	SCA Checks	high
113203	Jolokia 1.3.7 < 1.5.0 Remote Code Execution	Web App Scanning	Component Vulnerability	high

Detections

Analytics

CVE-2018-1000130

high

Tenable Plugins

high

high

high