hawtio before versions 2.0-beta-1, 2.0-beta-2, 2.0-m1, 2.0-m2, 2.0-m3, and 1.5 are vulnerable to a path traversal that leads to a NullPointerException with a full stacktrace. An attacker could use this flaw to gather undisclosed information from within hawtio's root.
{
"cwe_ids": [
"CWE-22"
],
"github_reviewed": true,
"severity": "HIGH",
"github_reviewed_at": "2022-11-04T20:36:05Z",
"nvd_published_at": "2018-05-08T17:29:00Z"
}