CVE-2017-7556
Cross-Site Request Forgery in hawtio
Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their website containing a malicious script which can be submitted to hawtio server on behalf of the user.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their website containing a malicious script which can be submitted to hawtio server on behalf of the user.
- Record
CVE-2017-7556- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their website containing a malicious script which can be submitted to hawtio server on behalf of the user.
- Record
CVE-2017-7556- Weakness
- CWE-352
- Updated
- 2026-11-02
EUVDEUVD-2022-4882 No score
Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their website containing a malicious script which can be submitted to hawtio server on behalf of the user.
- Record
EUVD-2022-4882- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q4q2-fvwf-6ghv
Cross-Site Request Forgery in hawtio
It was found that hawtio contains a CSRF flaw that allows unrelated websites to perform actions as the authenticated user. Attackers could use this vulnerability to trick the user to visit his website that contains a malicious script which can be submitted to hawtio server on behalf of the user.
- Record
GHSA-q4q2-fvwf-6ghv- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV
Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their website containing a malicious script which can be submitted to hawtio server on behalf of the user.
- Record
CVE-2017-7556- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-q4q2-fvwf-6ghv
Cross-Site Request Forgery in hawtio
It was found that hawtio contains a CSRF flaw that allows unrelated websites to perform actions as the authenticated user. Attackers could use this vulnerability to trick the user to visit his website that contains a malicious script which can be submitted to hawtio server on behalf of the user.
- Record
GHSA-q4q2-fvwf-6ghv- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.hawt:projectMaven |
before 1.5.4 | 1.5.4 |
io.hawt:projectMaven |
before 1.5.4, plus listed versions 1.01.11.2-M11.2-M101.2-M11 Show 45 moreShow less1.2-M131.2-M141.2-M161.2-M191.2-M21.2-M201.2-M221.2-M231.2-M241.2-M251.2-M261.2-M271.2-M31.2-M41.2-M51.2-M61.2-M71.2-M81.2-M91.2.01.2.11.2.21.2.31.3.01.3.11.4.01.4.11.4.101.4.111.4.121.4.141.4.151.4.161.4.171.4.181.4.191.4.21.4.201.4.211.4.221.4.231.4.241.4.251.4.261.4.27 |
1.5.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-7556 is a high vulnerability (CVSS 8.8) in Hawt Hawtio, published August 17, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.68%, the 52nd percentile. Fixed in io.hawt:project 1.5.4.
References
Left out here: 52 versions. The JSON record has them.