CVE-2018-1000129
Cross-site Scripting in Jolokia agent
An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
- Record
CVE-2018-1000129- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
- Record
CVE-2018-1000129- Updated
- 2026-11-02
EUVDEUVD-2022-4136 No score
An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
- Record
EUVD-2022-4136- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hfpg-gqjw-779m
Cross-site Scripting in Jolokia agent
An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
- Record
GHSA-hfpg-gqjw-779m- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
- Record
CVE-2018-1000129- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-hfpg-gqjw-779m
Cross-site Scripting in Jolokia agent
An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
- Record
GHSA-hfpg-gqjw-779m- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jolokia:jolokia-coreMaven |
1.3.7 up to 1.5.0 | 1.5.0 |
org.jolokia:jolokia-coreMaven |
1.3.7 up to 1.5.0, plus listed versions 1.4.0 |
1.5.0 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Jolokia 1.3.7 - Cross-Site Scripting | |
| PoC in GitHub | shoucheng3/rhuss__jolokia_CVE-2018-1000129_1-4-0 | 2025-08-16 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1000129 is a medium vulnerability (CVSS 6.1) in Jolokia, published March 14, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 24.7%, the 97th percentile. Fixed in org.jolokia:jolokia-core 1.5.0.
References
github.com/rhuss/jolokia/commit/5895d5c137c335e6b473e9dcb9baf748851bbc5f
access.redhat.com/errata/RHSA-2018:3817
jolokia.org
nvd.nist.gov/vuln/detail/CVE-2018-1000129