The admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary commands via the k parameter.
The MITRE CVE dictionary describes this issue as:
Find out more about CVE-2014-0121 from the MITRE CVE dictionary dictionary and NIST NVD.
Not vulnerable. This issue only affects Red Hat JBoss Fuse 6.1.0 Beta. It is resolved in the general availability release of Red Hat JBoss Fuse 6.1.0. Earlier versions of Red Hat JBoss Fuse are not affected, as they did not include the hawtio-karaf-terminal component.
NOTE: The following CVSS v2 metrics and score provided are preliminary and subject to review.
| Base Score | 6.5 |
|---|---|
| Base Metrics | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| Access Vector | Network |
| Access Complexity | Low |
| Authentication | Single |
| Confidentiality Impact | Partial |
| Integrity Impact | Partial |
| Availability Impact | Partial |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
Vulmon