Medium
Security advisory
An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2018-1000129
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:15 UTC · Revision 1
Source evidence
An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
osv:CVE-2018-1000129
Complete source record
{
"id": "8c55a58be6bf0fda3438d6ef65a016ce518fe0784f532e213c3e3b0f6e60eeb0",
"url": "https://osv.dev/vulnerability/CVE-2018-1000129",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2018-1000129",
"summary": "An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.",
"evidence": "osv:CVE-2018-1000129",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2018-1000129",
"aliases": [
"CVE-2018-1000129",
"GHSA-hfpg-gqjw-779m"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/jolokia/jolokia",
"type": "GIT",
"events": [
{
"introduced": "62063241d69071cbb0f2de400e55e03e182d48f0"
},
{
"last_affected": "62063241d69071cbb0f2de400e55e03e182d48f0"
},
{
"fixed": "5895d5c137c335e6b473e9dcb9baf748851bbc5f"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:jolokia:jolokia:1.3.7:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.3.7"
},
{
"last_affected": "1.3.7"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "5895d5c137c335e6b473e9dcb9baf748851bbc5f"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"1.3.7",
"v1.3.7"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1000129.json",
"vanir_signatures": [
{
"id": "CVE-2018-1000129-0048e600",
"digest": {
"length": 1405,
"function_hash": "9101056780195105689920133383899428046"
},
"source": "https://github.com/jolokia/jolokia/commit/5895d5c137c335e6b473e9dcb9baf748851bbc5f",
"target": {
"file": "agent/core/src/test/java/org/jolokia/http/AgentServletTest.java",
"function": "getDiscoveryRequestSetup"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-1000129-0a363c3f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"322579074830711164226773791865499204624",
"189530333012166654566602915798034352130",
"306423491282529189312106739647177880839",
"259859842179615747923413111175627510808",
"69620368231400835285696712560885807206",
"149313712084145230586326962979678089336",
"295388771877549977418559681537518765825",
"186380120627169719143814779174366309450",
"131149424061759048693215128520056287458",
"213237586619634623957501232443969987885",
"185737868763434592322467993731449362334",
"239133993715873104158459971400449695412",
"216135847001655948063772882668149046836",
"248825708073826894222007982378907792503",
"312797572052543304168913347663493369755",
"188476763488321601678444835619441637106",
"226131966385192981411437141245902152635",
"210892880344943549020616013610956749889",
"335530534240242085467588192130757930779",
"329389237566014223813045761243060814082",
"252151999791783203150675505654268341582",
"96719565643970355438540918716585321803",
"143966134788136765370517971805183702849",
"16928909982670677882773219120866201390",
"290901781272016592815164192211270355070",
"129542590537532731959952868876767820497",
"202814960352905072027872440581204394360",
"148079492397554292746581120871103176451",
"265080038802942667856771025826259334866",
"52047066003553578698499998192238594577",
"301249501783902903221702621835386937579",
"47319574122266361452121348993468076779",
"223085498940811731331867615267004949204"
]
},
"source": "https://github.com/jolokia/jolokia/commit/5895d5c137c335e6b473e9dcb9baf748851bbc5f",
"target": {
"file": "agent/core/src/main/java/org/jolokia/http/AgentServlet.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-1000129-3950972f",
"digest": {
"length": 627,
"function_hash": "318693816369166035080453627462080144436"
},
"source": "https://github.com/jolokia/jolokia/commit/5895d5c137c335e6b473e9dcb9baf748851bbc5f",
"target": {
"file": "agent/core/src/main/java/org/jolokia/http/AgentServlet.java",
"function": "handle"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-1000129-3f2ff1d6",
"digest": {
"threshold": 0.9,
"line_hashes": [
"139185877502046714325244808070405122169",
"279385843841075575978169075043478735727",
"69267569277709244185947320817078564806",
"32209790656384625764904978686685292125",
"331097791619726263950769105724946651235",
"311079486246782707659818065859473127759",
"199666665161127611945529724818868989093",
"286150243023442049833300263173999611672",
"37613195430094680050301250793175626423",
"101033525906028951742835252723874111545",
"170602002210268775604442384187007026184",
"270531560088762048219456239466125261542",
"299600780299719901107796902817784584384",
"260793016060752341367011178043949998693",
"42405328934602996883232985673382951680",
"130185908982787457428233159679101082675",
"151687224537737776528390342927588492446",
"264441864819777682271981259521613168497",
"188002597876702691823980583839838580068",
"9073344715051578852998543584689159933",
"17903697813419979356869670819986713136",
"121587391670071556234598171785476640948",
"192501316437810862462065871001941857859",
"159284052109742014227591084501594789933",
"49108499340008531001607933016019910202",
"248199188390185979360298832217961639029"
]
},
"source": "https://github.com/jolokia/jolokia/commit/5895d5c137c335e6b473e9dcb9baf748851bbc5f",
"target": {
"file": "agent/core/src/test/java/org/jolokia/http/AgentServletTest.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-1000129-4ec2b082",
"digest": {
"length": 517,
"function_hash": "176515373183824167771589970109166652662"
},
"source": "https://github.com/jolokia/jolokia/commit/5895d5c137c335e6b473e9dcb9baf748851bbc5f",
"target": {
"file": "agent/jvm/src/main/java/org/jolokia/jvmagent/handler/JolokiaHttpHandler.java",
"function": "sendStreamingResponse"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-1000129-543ae629",
"digest": {
"threshold": 0.9,
"line_hashes": [
"301954502973065940646504624872861875120",
"92458082184810938691960783790390537275",
"10868231959371407768640310267786566408",
"180518493518659246499941531007032751034",
"254429179852842707729772983358650024827",
"332889175936897901919091520693798026087",
"144681765056933479645312836678427262457",
"301081427366350833582536272637503154074",
"1342368364974942284101625098413771746",
"279177821797824943891303711844176138339",
"312765938797726340378032191272616305675",
"68048483911930171716616004505398968633",
"169085874185239899801460138444439657343",
"157365836075482152558320146484841620995",
"149382513596390492901920652508267179406",
"73257839641540469060443806442610120778",
"44487914402517661061431778606325471293",
"320555726524483358722809028902168335701",
"303672623282734745943271529362691655520",
"214141803145575229843556532138971899199",
"74812573416084759948185611009382294882",
"21244283739348405738651496313380610881",
"119668980241708692914013269020024092636",
"161912559410549300060696364894333789189",
"28190343666036167411889131187951065759",
"335856134958540948697803478001065451425",
"324720995121193233924201538644140388348",
"263083663737044535732847376474296455947",
"174419458231127260959960139037879985649",
"300165052430266612071486933217704679972"
]
},
"source": "https://github.com/jolokia/jolokia/commit/5895d5c137c335e6b473e9dcb9baf748851bbc5f",
"target": {
"file": "agent/jvm/src/main/java/org/jolokia/jvmagent/handler/JolokiaHttpHandler.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-1000129-60d9e064",
"digest": {
"length": 166,
"function_hash": "155931549294997905269935090254874906723"
},
"source": "https://github.com/jolokia/jolokia/commit/5895d5c137c335e6b473e9dcb9baf748851bbc5f",
"target": {
"file": "agent/core/src/main/java/org/jolokia/http/AgentServlet.java",
"function": "getMimeType"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-1000129-6a2d745d",
"digest": {
"length": 466,
"function_hash": "257338182400736283720558969940301469589"
},
"source": "https://github.com/jolokia/jolokia/commit/5895d5c137c335e6b473e9dcb9baf748851bbc5f",
"target": {
"file": "agent/core/src/main/java/org/jolokia/http/AgentServlet.java",
"function": "sendResponse"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-1000129-6efc654e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"128966036264653250021833138380838131029",
"220602111021858709995908895350384764140",
"293968631327864538848172684348141784459",
"212949425592525559176455072602133132945",
"283449627292906983725607372066729304880",
"336364982103558014850221698853929805537"
]
},
"source": "https://github.com/jolokia/jolokia/commit/5895d5c137c335e6b473e9dcb9baf748851bbc5f",
"target": {
"file": "agent/jvm/src/test/java/org/jolokia/jvmagent/handler/JolokiaHttpHandlerTest.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-1000129-8693cdff",
"digest": {
"length": 648,
"function_hash": "329720143229288237642001777985324975099"
},
"source": "https://github.com/jolokia/jolokia/commit/5895d5c137c335e6b473e9dcb9baf748851bbc5f",
"target": {
"file": "agent/core/src/test/java/org/jolokia/http/AgentServletTest.java",
"function": "initRequestResponseMocks"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-1000129-8d5f2505",
"digest": {
"length": 641,
"function_hash": "10674157705063168995233629529946089205"
},
"source": "https://github.com/jolokia/jolokia/commit/5895d5c137c335e6b473e9dcb9baf748851bbc5f",
"target": {
"file": "agent/core/src/test/java/org/jolokia/http/AgentServletTest.java",
"function": "withCallback"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-1000129-93f95e6c",
"digest": {
"length": 693,
"function_hash": "210268741973837036099668555107674427325"
},
"source": "https://github.com/jolokia/jolokia/commit/5895d5c137c335e6b473e9dcb9baf748851bbc5f",
"target": {
"file": "agent/jvm/src/main/java/org/jolokia/jvmagent/handler/JolokiaHttpHandler.java",
"function": "sendAllJSON"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-1000129-bce441b2",
"digest": {
"length": 1263,
"function_hash": "84765245254986071811334277203355841670"
},
"source": "https://github.com/jolokia/jolokia/commit/5895d5c137c335e6b473e9dcb9baf748851bbc5f",
"target": {
"file": "agent/core/src/test/java/org/jolokia/http/AgentServletTest.java",
"function": "run"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-1000129-ccbf408b",
"digest": {
"length": 913,
"function_hash": "336846672887242153409891097757785601106"
},
"source": "https://github.com/jolokia/jolokia/commit/5895d5c137c335e6b473e9dcb9baf748851bbc5f",
"target": {
"file": "agent/jvm/src/main/java/org/jolokia/jvmagent/handler/JolokiaHttpHandler.java",
"function": "doHandle"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-1000129-cfd75b21",
"digest": {
"length": 379,
"function_hash": "290356750051607027705265754031790392056"
},
"source": "https://github.com/jolokia/jolokia/commit/5895d5c137c335e6b473e9dcb9baf748851bbc5f",
"target": {
"file": "agent/jvm/src/main/java/org/jolokia/jvmagent/handler/JolokiaHttpHandler.java",
"function": "getMimeType"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:24:41Z"
}
}
],
"modified": "2026-10-20T13:24:41.639181138Z",
"provider": "osv",
"references": [
"https://access.redhat.com/errata/RHSA-2018:2669",
"https://access.redhat.com/errata/RHSA-2018:3817",
"https://jolokia.org/#Security_fixes_with_1.5.0",
"https://github.com/rhuss/jolokia/commit/5895d5c137c335e6b473e9dcb9baf748851bbc5f#diff-f19898247eddb55de6400489bff748ad"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2018-1000129",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 387643,
"published_at": "2018-03-14T13:29:00.237+00:00"
}