{"id":"RHLW-2026-b317db59e3a4f8c7","summary":"Lightwell Security Advisory: jolokia-core 1.3.7.rhlw-00001","details":"Red Hat Lightwell has released org.jolokia:jolokia-core 1.3.7.rhlw-00001 with backported fixes for CVE-2018-1000129 and CVE-2018-10899.\n\nCVE-2018-1000129: An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.\n\nCVE-2018-10899: A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured instances with strict checking for origin and referrer headers. This could result in a Remote Code Execution attack.\n\nThis patched artifact is a drop-in replacement for org.jolokia:jolokia-core 1.3.7 from Maven Central.","modified":"2026-11-10T08:30:02.508535028Z","published":"2026-11-05T16:17:39Z","upstream":["CVE-2018-1000129","CVE-2018-10899","GHSA-hfpg-gqjw-779m","GHSA-xcxf-7q4p-cj26"],"references":[{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2669"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:3817"},{"type":"FIX","url":"https://github.com/rhuss/jolokia/commit/5895d5c137c335e6b473e9dcb9baf748851bbc5f#diff-f19898247eddb55de6400489bff748ad"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000129"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hfpg-gqjw-779m"},{"type":"WEB","url":"https://lists.apache.org/thread.html/1392fbebb4fbbec379a40d16e1288fe1e4c0289d257e5206051a3793%40%3Cissues.activemq.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r46f6dbc029f49e1f638c6eb82accb94b7f990d818cb3b3bc0007dd0a%40%3Cissues.activemq.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r64701caec91c43efd7416d6bddef88447371101e00e8562741ede262%40%3Cissues.activemq.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r67cdc50af9caf89c9ebe1bde08393a343dcd89edba1c63677f68f43b%40%3Cissues.activemq.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rc169dac018d07e8ddf2a3bb2fd1efc6cbda4f83f1bbf7a8c798e7f4f%40%3Cissues.activemq.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rdb0a59d7851e721b75beea13d6488e345a3e2735838e89d9269d7d32%40%3Cissues.activemq.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rf33ffbba619a4281ce592a6ed259c07a557aefb4975619d83c4122ea%40%3Cissues.activemq.apache.org%3E"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:2413"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:2804"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-10899"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-xcxf-7q4p-cj26"}],"affected":[{"package":{"name":"org.jolokia:jolokia-core","ecosystem":"Red Hat Lightwell:Maven","purl":"pkg:maven/org.jolokia/jolokia-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.7.rhlw-00001"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7"],"database_specific":{"lightwell":{"remediated_version":"1.3.7.rhlw-00001","repository_url":"https://packages.redhat.com/lightwell/java/remediated/","backport_base_version":"1.3.7"},"source":"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-b317db59e3a4f8c7.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"credits":[{"name":"Red Hat Lightwell","type":"REMEDIATION_DEVELOPER"}]}