Read the docs
TI-2019-07212 Aliases CVE-2019-9827GHSA-mcg9-64cp-xwp7

Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an…

Priority MEDIUM 64CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 3 fixed, 3 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI.

Why it matters now

EPSS 0.26803 98th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial io.hawt:hawtio-core (Maven): 2.5.0Red Hat: 4 advisoriesRed Hat: 3 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—io.hawt:hawtio-core (Maven)before 2.5.02.5.0Patch availableGHSA-mcg9-64cp-xwp7
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • io.hawt:hawtio-core (Maven) Vendor— Affected before 2.5.0 Fixed in 2.5.0 Patch available GHSA-mcg9-64cp-xwp7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hawt:hawtio:*:*:*:*:*:*:*:*up to 2.5.0VulnerableHawt
  • cpe:2.3:a:hawt:hawtio:*:*:*:*:*:*:*:* Versions up to 2.5.0 Vulnerable ·Hawt

Remediation

  • Fix · GHSA-mcg9-64cp-xwp7 io.hawt:hawtio-core (Maven) Fixed in 2.5.0 Advisory →

Red Hat 4 advisories

  • RHSA-2020:5365 Released 2020-12-08 · Red Hat rating Moderate
    Red Hat AMQ Broker 7.8 release and security update
    • Red Hat AMQ
  • RHSA-2020:4154 Released 2020-10-01 · Red Hat rating Moderate
    Red Hat AMQ Broker 7.4.5 release and security update
    • Red Hat AMQ
  • RHSA-2020:3587 Released 2020-09-01 · Red Hat rating Important
    Red Hat JBoss Fuse/A-MQ 6.3 R17 security and bug fix update
    • Red Hat Fuse 6.3
Show 1 more Red Hat advisories
  • RHSA-2020:3192 Released 2020-07-28 · Red Hat rating Important
    Red Hat Fuse 7.7.0 release and security update
    • Red Hat Fuse 7.7.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AMQ Broker 7AffectedNo fix yet
Red Hat JBoss A-MQ 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat AMQFixed RHSA-2020:4154
Red Hat Fuse 6.3Fixed RHSA-2020:3587
Red Hat Fuse 7.7.0Fixed RHSA-2020:3192

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-9827
  2. 2026-10-03 Alias added: GHSA-mcg9-64cp-xwp7

References

Exploit 1

Advisory 1

Other 1

  • TI-2023-16572 hawtio 2.17.2 is vulnerable to Path Traversal. CVSS 3.1MEDIUM 5.5
  • TI-2014-00115 The admin terminal in Hawt.io does not require authentication, which allows remote… CVSS 3.0CRITICAL 9.8
  • TI-2017-01843 Improper authorization in Red Hat hawtio CVSS 3.0CRITICAL 9.0
  • TI-2014-00114 Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows… CVSS 3.0HIGH 8.8
  • TI-2017-05197 Cross-site request forgery in Red Hat hawtio CVSS 3.0HIGH 8.8
  • TI-2017-01868 Improper input validation in [UNKNOWN] hawtio CVSS 3.0HIGH 7.8
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences