Misconfiguration of Java web server component Jolokia puts orgs at risk

guest · Jun 25, 2018

Misconfiguration of Java web server component Jolokia puts orgs at risk
You gotta shore it up before you put it to work, says researcher
June 25, 2018
https://www.theregister.co.uk/2018/06/25/java_web_server_jolokia_insecure/

Shortcomings in Jolokia's Java Management Extensions (JMX) open the door to information disclosure, denial of service, and other potential attacks against Java web servers.

The problem arises because some distributions of Jolokia, such as the WAR agent, are "insecure by default", Mannion said. Although Jolokia is mostly deployed as a monitoring technology, the scope for abuse is quite extensive.

Roland Huss, maintainer of Jolokia, also agreed Mannion had a point while arguing that this related to an insecure setup issue rather than a bug.
"I do believe it's a serious issue, but its not a bug in Jolokia," Huss said.
Click to expand...

Log in or Sign up

Misconfiguration of Java web server component Jolokia puts orgs at risk

guest Guest

Log in or Sign up

Misconfiguration of Java web server component Jolokia puts orgs at risk

guest Guest

Useful Searches