CVE-2017-2589
Insecure cookie sharing in Hawtio
It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.
- Record
CVE-2017-2589- CVSS 3.0
- 8.7 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-285
- Updated
- 2026-11-02
EUVDEUVD-2022-4488
It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.
- Record
EUVD-2022-4488- CVSS 3.0
- 8.7 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m4j5-hgqq-5jf2
Insecure cookie sharing in Hawtio
It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.
- Record
GHSA-m4j5-hgqq-5jf2- CVSS 3.0
- 9.0 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-200
- Updated
- 2026-11-02
NVD
It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.
- Record
CVE-2017-2589- CVSS 3.0
- 8.7 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N - CVSS 3.0
- 9.0 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - CVSS 2.0
- 6.0 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:P - Weakness
- CWE-285
- Updated
- 2026-11-02
OSV
It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.
- Record
CVE-2017-2589- CVSS 3.0
- 9.0 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-m4j5-hgqq-5jf2
Insecure cookie sharing in Hawtio
It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.
- Record
GHSA-m4j5-hgqq-5jf2- CVSS 3.0
- 9.0 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.hawt:projectMaven |
before 1.5.0 | 1.5.0 |
io.hawt:projectMaven |
before 1.5.0, plus listed versions 1.01.11.2-M11.2-M101.2-M11 Show 45 moreShow less1.2-M131.2-M141.2-M161.2-M191.2-M21.2-M201.2-M221.2-M231.2-M241.2-M251.2-M261.2-M271.2-M31.2-M41.2-M51.2-M61.2-M71.2-M81.2-M91.2.01.2.11.2.21.2.31.3.01.3.11.4.01.4.11.4.101.4.111.4.121.4.141.4.151.4.161.4.171.4.181.4.191.4.21.4.201.4.211.4.221.4.231.4.241.4.251.4.261.4.27 |
1.5.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-2589 is a high vulnerability (CVSS 8.7) in Hawt Hawtio, published July 26, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.93%, the 60th percentile. Fixed in io.hawt:project 1.5.0.
References
Left out here: 47 versions. The JSON record has them.