Vulnerability record · CVE-2017-2617 · published 22 May 2018

CVE-2017-2617: Hawtio improper input validation vulnerability

Hawt · Hawtio

hawtio before version 1.5.5 is vulnerable to remote code execution via file upload. An attacker could use this vulnerability to upload a crafted file which could be executed on a target machine where hawtio is deployed.

7.8 CVSS 3.0 High EPSS 1.7% · top 23.9% CWE-20 · Improper input validationCWE-434 · Unrestricted file upload

7.8CVSS 3.0 base score, v2 6.8

1.7%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Hawtio Hawt

References

Link	Tags
http://www.securityfocus.com/bid/96036	Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2018:0319	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2617	Issue TrackingThird Party Advisory
http://www.securityfocus.com/bid/96036	Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2018:0319	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2617	Issue TrackingThird Party Advisory

Track CVE-2017-2617 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-9827Hawtio server-side request forgery (ssrf) vulnerabilityHawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host v…EPSS 27%3 Jul 2019 9.8CVE-2014-0121Hawtio improper authentication vulnerabilityThe admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary commands via the k parameter.EPSS 3.9%29 Dec 2017 9.0CVE-2017-2589Hawtio improper authorization vulnerabilityIt was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored …EPSS 0.93%26 Jul 2018 8.8CVE-2014-0120Hawtio cross-site request forgery vulnerabilityCross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arbitrary us…EPSS 1.2%29 Dec 2017 8.8CVE-2017-7556Hawtio cross-site request forgery vulnerabilityHawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their website con…EPSS 0.68%17 Aug 2017 7.5CVE-2017-2594Hawtio error message information leak vulnerabilityhawtio before versions 2.0-beta-1, 2.0-beta-2 2.0-m1, 2.0-m2, 2.0-m3, and 1.5 is vulnerable to a path traversal that leads to a NullPointerException …EPSS 1.9%8 May 2018 5.5CVE-2023-33544Hawtio path traversal vulnerabilityhawtio 2.17.2 is vulnerable to Path Traversal. it is possible to input malicious zip files, which can result in the high-risk files after decompressi…EPSS 0.30%1 Jun 2023 9.5CVE-2026-88771Citrix netscaler application delivery controller improper input validation vulnerabilityImproper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-…KEVEPSS 1.1%27 Sep 2026

Source: NIST National Vulnerability Database (record CVE-2017-2617), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.