A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to run arbitrary Java c

Summary

A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to run arbitrary Java code on the server.

Timeline

1. Mar 14, 2018, 1:00 PM UTCCVE published
2. Aug 5, 2024, 12:33 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

• org.jolokia:jolokia-coreMaven

  From 1.3.7 · fixed in 1.5.0

References 3