RHLW-2026-b317db59e3a4f8c7

See a problem?
Please try reporting it to the source first.

Source

https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-b317db59e3a4f8c7.json

Import Source

https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-b317db59e3a4f8c7.json

JSON Data

https://api.osv.dev/v1/vulns/RHLW-2026-b317db59e3a4f8c7

Upstream

CVE (2)

GHSA (2)

Published

2026-11-05T16:17:39Z

Modified

2026-11-10T08:30:02Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Lightwell Security Advisory: jolokia-core 1.3.7.rhlw-00001

Details

Red Hat Lightwell has released org.jolokia:jolokia-core 1.3.7.rhlw-00001 with backported fixes for CVE-2018-1000129 and CVE-2018-10899.

CVE-2018-1000129: An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.

CVE-2018-10899: A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured instances with strict checking for origin and referrer headers. This could result in a Remote Code Execution attack.

This patched artifact is a drop-in replacement for org.jolokia:jolokia-core 1.3.7 from Maven Central.

References

Credits

- Red Hat Lightwell - REMEDIATION_DEVELOPER

Affected packages

Red Hat Lightwell:Maven / org.jolokia:jolokia-core

Package

Name: org.jolokia:jolokia-core
Purl: pkg:maven/org.jolokia/jolokia-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.3.7.rhlw-00001

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.1.5

1.2.0

1.2.1

1.2.2

1.2.3

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

Database specific

lightwell

{
    "backport_base_version": "1.3.7",
    "remediated_version": "1.3.7.rhlw-00001",
    "repository_url": "https://packages.redhat.com/lightwell/java/remediated/"
}

source

"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-b317db59e3a4f8c7.json"