hawtio 2.17.2 is vulnerable to Path Traversal.
Priority MEDIUM 58CWE-22Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Will not fix Red Hat: no fix planned
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.
Summary
hawtio 2.17.2 is vulnerable to Path Traversal. it is possible to input malicious zip files, which can result in the high-risk files after decompression being stored in any location, even leading to file overwrite.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00304 23rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Will not fix Red Hat: no fix planned
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | io.hawt:project (Maven) | up to 2.17.2 | — | No fix listed | GHSA-p223-c4w6-q454 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- io.hawt:project (Maven) Vendor— Affected up to 2.17.2 Fixed in — No fix listed GHSA-p223-c4w6-q454
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
Not affected: 5 products
- Red Hat AMQ Broker 7
- Red Hat Fuse 7
- Red Hat JBoss Data Grid 7
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform Expansion Pack
Timeline
- 2026-10-02 Threatist record created from CVE-2023-33544
- 2026-10-03 Alias added: GHSA-p223-c4w6-q454
References
More Hawtio vulnerabilities
- TI-2019-07212 Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an… CVSS 3.0CRITICAL 9.8
- TI-2014-00115 The admin terminal in Hawt.io does not require authentication, which allows remote… CVSS 3.0CRITICAL 9.8
- TI-2017-01843 Improper authorization in Red Hat hawtio CVSS 3.0CRITICAL 9.0
- TI-2014-00114 Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows… CVSS 3.0HIGH 8.8
- TI-2017-05197 Cross-site request forgery in Red Hat hawtio CVSS 3.0HIGH 8.8
- TI-2017-01868 Improper input validation in [UNKNOWN] hawtio CVSS 3.0HIGH 7.8
Sources
- CVE-2023-33544 · CVE Program
- CVE-2023-33544 · NVD
- FIRST EPSS
- GHSA-p223-c4w6-q454 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-33544 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences