CVE-2019-9827
Server-Side Request Forgery in Hawt Hawtio
Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI.
- Record
CVE-2019-9827- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-918
- Updated
- 2026-11-02
CVE List No score
Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI.
- Record
CVE-2019-9827- Updated
- 2026-11-02
EUVDEUVD-2019-0598 No score
Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI.
- Record
EUVD-2019-0598- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mcg9-64cp-xwp7
Server-Side Request Forgery in Hawt Hawtio
Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI.
- Record
GHSA-mcg9-64cp-xwp7- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-918
- Updated
- 2026-11-02
OSV
Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI.
- Record
CVE-2019-9827- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-mcg9-64cp-xwp7
Server-Side Request Forgery in Hawt Hawtio
Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI.
- Record
GHSA-mcg9-64cp-xwp7- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-918
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.hawt:hawtio-coreMaven |
before 2.5.0 | 2.5.0 |
io.hawt:hawtio-coreMaven |
before 2.5.0, plus listed versions 1.11.2-M11.2-M101.2-M111.2-M13 Show 45 moreShow less1.2-M141.2-M161.2-M191.2-M21.2-M201.2-M221.2-M231.2-M241.2-M251.2-M261.2-M271.2-M31.2-M41.2-M51.2-M61.2-M71.2-M81.2-M91.2.01.2.11.2.21.2.31.3.01.3.11.4.01.4.11.4.101.4.111.4.121.4.141.4.151.4.161.4.171.4.181.4.191.4.21.4.201.4.211.4.221.4.231.4.241.4.251.4.261.4.271.4.28 |
2.5.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-9827 is a critical vulnerability (CVSS 9.8) in Hawt Hawtio, published July 3, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 26.8%, the 98th percentile. Fixed in io.hawt:hawtio-core 2.5.0.
References
Left out here: 73 versions. The JSON record has them.