cve-2018-1000130

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/vex/2018/cve-2018-1000130.json"
      }
    ],
    "title": "jolokia: JMX proxy mode vulnerable to remote code execution",
    "tracking": {
      "current_release_date": "2026-05-14T18:01:29+00:00",
      "generator": {
        "date": "2026-05-14T18:01:29+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "CVE-2018-1000130",
      "initial_release_date": "2018-02-08T00:00:00+00:00",
      "revision_history": [
        {
          "date": "2018-02-08T00:00:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-05-14T17:04:20+00:00",
          "number": "2",
          "summary": "Current version"
        },
        {
          "date": "2026-05-14T18:01:29+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "JBoss Developer Studio 11",
                "product": {
                  "name": "JBoss Developer Studio 11",
                  "product_id": "jboss_developer_studio_11",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_dev_studio:11."
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "JBoss Developer Studio 11"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat AMQ Broker 7",
                "product": {
                  "name": "Red Hat AMQ Broker 7",
                  "product_id": "red_hat_amq_broker_7",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:amq_broker:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat AMQ Broker 7"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux OpenStack Platform 7 (Kilo)",
                "product": {
                  "name": "Red Hat Enterprise Linux OpenStack Platform 7 (Kilo)",
                  "product_id": "red_hat_enterprise_linux_openstack_platform_7_(kilo)",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openstack:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux OpenStack Platform 7 (Kilo)"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss A-MQ 6",
                "product": {
                  "name": "Red Hat JBoss A-MQ 6",
                  "product_id": "red_hat_jboss_a-mq_6",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_amq:6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss A-MQ 6"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Data Virtualization 6",
                "product": {
                  "name": "Red Hat JBoss Data Virtualization 6",
                  "product_id": "red_hat_jboss_data_virtualization_6",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_data_virtualization:6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Data Virtualization 6"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Fuse 6",
                "product": {
                  "name": "Red Hat JBoss Fuse 6",
                  "product_id": "red_hat_jboss_fuse_6",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_fuse:6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Fuse 6"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Fuse Integration Service 2",
                "product": {
                  "name": "Red Hat JBoss Fuse Integration Service 2",
                  "product_id": "red_hat_jboss_fuse_integration_service_2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:fuse_integration_services:2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Fuse Integration Service 2"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenStack Platform 10 (Newton)",
                "product": {
                  "name": "Red Hat OpenStack Platform 10 (Newton)",
                  "product_id": "red_hat_openstack_platform_10_(newton)",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openstack:10"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenStack Platform 10 (Newton)"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenStack Platform 11 (Ocata)",
                "product": {
                  "name": "Red Hat OpenStack Platform 11 (Ocata)",
                  "product_id": "red_hat_openstack_platform_11_(ocata)",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openstack:11"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenStack Platform 11 (Ocata)"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenStack Platform 12 (Pike)",
                "product": {
                  "name": "Red Hat OpenStack Platform 12 (Pike)",
                  "product_id": "red_hat_openstack_platform_12_(pike)",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openstack:12"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenStack Platform 12 (Pike)"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenStack Platform 13 (Queens)",
                "product": {
                  "name": "Red Hat OpenStack Platform 13 (Queens)",
                  "product_id": "red_hat_openstack_platform_13_(queens)",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openstack:13"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenStack Platform 13 (Queens)"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenStack Platform 8 (Liberty)",
                "product": {
                  "name": "Red Hat OpenStack Platform 8 (Liberty)",
                  "product_id": "red_hat_openstack_platform_8_(liberty)",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openstack:8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenStack Platform 8 (Liberty)"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenStack Platform 9 (Mitaka)",
                "product": {
                  "name": "Red Hat OpenStack Platform 9 (Mitaka)",
                  "product_id": "red_hat_openstack_platform_9_(mitaka)",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openstack:9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenStack Platform 9 (Mitaka)"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Fuse 7",
                "product": {
                  "name": "Red Hat JBoss Fuse 7",
                  "product_id": "Red Hat JBoss Fuse 7",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_fuse:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Fuse"
          },
          {
            "category": "product_version",
            "name": "jolokia-core",
            "product": {
              "name": "jolokia-core",
              "product_id": "jolokia-core"
            }
          },
          {
            "category": "product_version",
            "name": "opendaylight.src",
            "product": {
              "name": "opendaylight.src",
              "product_id": "opendaylight.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/opendaylight?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "jolokia-client-java",
            "product": {
              "name": "jolokia-client-java",
              "product_id": "jolokia-client-java"
            }
          },
          {
            "category": "product_version",
            "name": "opendaylight",
            "product": {
              "name": "opendaylight",
              "product_id": "opendaylight",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/opendaylight"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jolokia-core as a component of JBoss Developer Studio 11",
          "product_id": "jboss_developer_studio_11:jolokia-core"
        },
        "product_reference": "jolokia-core",
        "relates_to_product_reference": "jboss_developer_studio_11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jolokia-core as a component of Red Hat AMQ Broker 7",
          "product_id": "red_hat_amq_broker_7:jolokia-core"
        },
        "product_reference": "jolokia-core",
        "relates_to_product_reference": "red_hat_amq_broker_7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "opendaylight.src as a component of Red Hat Enterprise Linux OpenStack Platform 7 (Kilo)",
          "product_id": "red_hat_enterprise_linux_openstack_platform_7_(kilo):opendaylight.src"
        },
        "product_reference": "opendaylight.src",
        "relates_to_product_reference": "red_hat_enterprise_linux_openstack_platform_7_(kilo)"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jolokia-core as a component of Red Hat JBoss A-MQ 6",
          "product_id": "red_hat_jboss_a-mq_6:jolokia-core"
        },
        "product_reference": "jolokia-core",
        "relates_to_product_reference": "red_hat_jboss_a-mq_6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jolokia-client-java as a component of Red Hat JBoss Data Virtualization 6",
          "product_id": "red_hat_jboss_data_virtualization_6:jolokia-client-java"
        },
        "product_reference": "jolokia-client-java",
        "relates_to_product_reference": "red_hat_jboss_data_virtualization_6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jolokia-core as a component of Red Hat JBoss Fuse 6",
          "product_id": "red_hat_jboss_fuse_6:jolokia-core"
        },
        "product_reference": "jolokia-core",
        "relates_to_product_reference": "red_hat_jboss_fuse_6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jolokia-core as a component of Red Hat JBoss Fuse Integration Service 2",
          "product_id": "red_hat_jboss_fuse_integration_service_2:jolokia-core"
        },
        "product_reference": "jolokia-core",
        "relates_to_product_reference": "red_hat_jboss_fuse_integration_service_2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "opendaylight.src as a component of Red Hat OpenStack Platform 10 (Newton)",
          "product_id": "red_hat_openstack_platform_10_(newton):opendaylight.src"
        },
        "product_reference": "opendaylight.src",
        "relates_to_product_reference": "red_hat_openstack_platform_10_(newton)"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "opendaylight.src as a component of Red Hat OpenStack Platform 11 (Ocata)",
          "product_id": "red_hat_openstack_platform_11_(ocata):opendaylight.src"
        },
        "product_reference": "opendaylight.src",
        "relates_to_product_reference": "red_hat_openstack_platform_11_(ocata)"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "opendaylight.src as a component of Red Hat OpenStack Platform 12 (Pike)",
          "product_id": "red_hat_openstack_platform_12_(pike):opendaylight.src"
        },
        "product_reference": "opendaylight.src",
        "relates_to_product_reference": "red_hat_openstack_platform_12_(pike)"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "opendaylight as a component of Red Hat OpenStack Platform 13 (Queens)",
          "product_id": "red_hat_openstack_platform_13_(queens):opendaylight"
        },
        "product_reference": "opendaylight",
        "relates_to_product_reference": "red_hat_openstack_platform_13_(queens)"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "opendaylight.src as a component of Red Hat OpenStack Platform 13 (Queens)",
          "product_id": "red_hat_openstack_platform_13_(queens):opendaylight.src"
        },
        "product_reference": "opendaylight.src",
        "relates_to_product_reference": "red_hat_openstack_platform_13_(queens)"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "opendaylight.src as a component of Red Hat OpenStack Platform 8 (Liberty)",
          "product_id": "red_hat_openstack_platform_8_(liberty):opendaylight.src"
        },
        "product_reference": "opendaylight.src",
        "relates_to_product_reference": "red_hat_openstack_platform_8_(liberty)"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "opendaylight.src as a component of Red Hat OpenStack Platform 9 (Mitaka)",
          "product_id": "red_hat_openstack_platform_9_(mitaka):opendaylight.src"
        },
        "product_reference": "opendaylight.src",
        "relates_to_product_reference": "red_hat_openstack_platform_9_(mitaka)"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-1000130",
      "cwe": {
        "id": "CWE-99",
        "name": "Improper Control of Resource Identifiers ('Resource Injection')"
      },
      "discovery_date": "2018-03-14T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "jboss_developer_studio_11:jolokia-core",
            "red_hat_enterprise_linux_openstack_platform_7_(kilo):opendaylight.src",
            "red_hat_openstack_platform_11_(ocata):opendaylight.src",
            "red_hat_openstack_platform_8_(liberty):opendaylight.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1559316"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to run arbitrary Java code on the server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jolokia: JMX proxy mode vulnerable to remote code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "For Red Hat OpenStack Platform, although the affected code is present in shipped packages, proxy mode is not enabled by default and the affected code is not used in any supported configuration of Red Hat OpenStack Platform.  For this reason, the RHOSP impact as been reduced to Low and this issue is not currently planned to be addressed in future updates.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Fuse 7"
        ],
        "known_affected": [
          "red_hat_amq_broker_7:jolokia-core",
          "red_hat_jboss_a-mq_6:jolokia-core",
          "red_hat_jboss_data_virtualization_6:jolokia-client-java",
          "red_hat_jboss_fuse_6:jolokia-core",
          "red_hat_jboss_fuse_integration_service_2:jolokia-core",
          "red_hat_openstack_platform_10_(newton):opendaylight.src",
          "red_hat_openstack_platform_12_(pike):opendaylight.src",
          "red_hat_openstack_platform_13_(queens):opendaylight",
          "red_hat_openstack_platform_13_(queens):opendaylight.src",
          "red_hat_openstack_platform_9_(mitaka):opendaylight.src"
        ],
        "known_not_affected": [
          "jboss_developer_studio_11:jolokia-core",
          "red_hat_enterprise_linux_openstack_platform_7_(kilo):opendaylight.src",
          "red_hat_openstack_platform_11_(ocata):opendaylight.src",
          "red_hat_openstack_platform_8_(liberty):opendaylight.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-1000130"
        },
        {
          "category": "external",
          "summary": "RHBZ#1559316",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1559316"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-1000130",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-1000130"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000130",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000130"
        },
        {
          "category": "external",
          "summary": "https://jolokia.org/#Security_fixes_with_1.5.0",
          "url": "https://jolokia.org/#Security_fixes_with_1.5.0"
        }
      ],
      "release_date": "2018-02-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2018-09-11T07:53:47+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are located in the download section of the customer portal.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss Fuse 7"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2669"
        },
        {
          "category": "no_fix_planned",
          "details": "Out of support scope",
          "product_ids": [
            "red_hat_jboss_data_virtualization_6:jolokia-client-java"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Will not fix",
          "product_ids": [
            "red_hat_jboss_a-mq_6:jolokia-core",
            "red_hat_jboss_fuse_6:jolokia-core",
            "red_hat_openstack_platform_10_(newton):opendaylight.src",
            "red_hat_openstack_platform_12_(pike):opendaylight.src",
            "red_hat_openstack_platform_13_(queens):opendaylight",
            "red_hat_openstack_platform_13_(queens):opendaylight.src",
            "red_hat_openstack_platform_9_(mitaka):opendaylight.src"
          ]
        },
        {
          "category": "none_available",
          "details": "Affected",
          "product_ids": [
            "red_hat_amq_broker_7:jolokia-core",
            "red_hat_jboss_fuse_integration_service_2:jolokia-core"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Fuse 7",
            "jboss_developer_studio_11:jolokia-core",
            "red_hat_amq_broker_7:jolokia-core",
            "red_hat_enterprise_linux_openstack_platform_7_(kilo):opendaylight.src",
            "red_hat_jboss_a-mq_6:jolokia-core",
            "red_hat_jboss_data_virtualization_6:jolokia-client-java",
            "red_hat_jboss_fuse_6:jolokia-core",
            "red_hat_jboss_fuse_integration_service_2:jolokia-core",
            "red_hat_openstack_platform_10_(newton):opendaylight.src",
            "red_hat_openstack_platform_11_(ocata):opendaylight.src",
            "red_hat_openstack_platform_12_(pike):opendaylight.src",
            "red_hat_openstack_platform_13_(queens):opendaylight",
            "red_hat_openstack_platform_13_(queens):opendaylight.src",
            "red_hat_openstack_platform_8_(liberty):opendaylight.src",
            "red_hat_openstack_platform_9_(mitaka):opendaylight.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important",
          "product_ids": [
            "Red Hat JBoss Fuse 7",
            "jboss_developer_studio_11:jolokia-core",
            "red_hat_amq_broker_7:jolokia-core",
            "red_hat_enterprise_linux_openstack_platform_7_(kilo):opendaylight.src",
            "red_hat_jboss_a-mq_6:jolokia-core",
            "red_hat_jboss_data_virtualization_6:jolokia-client-java",
            "red_hat_jboss_fuse_6:jolokia-core",
            "red_hat_jboss_fuse_integration_service_2:jolokia-core",
            "red_hat_openstack_platform_8_(liberty):opendaylight.src"
          ]
        },
        {
          "category": "impact",
          "details": "Low",
          "product_ids": [
            "red_hat_openstack_platform_10_(newton):opendaylight.src",
            "red_hat_openstack_platform_11_(ocata):opendaylight.src",
            "red_hat_openstack_platform_12_(pike):opendaylight.src",
            "red_hat_openstack_platform_13_(queens):opendaylight",
            "red_hat_openstack_platform_13_(queens):opendaylight.src",
            "red_hat_openstack_platform_9_(mitaka):opendaylight.src"
          ]
        }
      ],
      "title": "jolokia: JMX proxy mode vulnerable to remote code execution"
    }
  ]
}