CVE-2014-0120: Hawt Hawtio

High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days.

Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arbitrary users for requests that run commands on the Karaf server, as demonstrated by running "shutdown -f."

Affected products

• Hawt Hawtio: up to and including 1.2.2
• Red Hat JBoss Fuse: version 6.1.0 only

Published 2017-12-29. Last modified 2026-06-17.