CVE-2014-0120

Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arbitrary users for requests that run commands on the Karaf server, as demonstrated by running "shutdown -f."

• CWE-352

• https://bugzilla.redhat.com/show_bug.cgi?id=1072681Issue Tracking, Patch, Third Party Advisory
• https://github.com/hawtio/hawtio/commit/b4e23e002639c274a2f687ada980118512f06113Issue Tracking, Patch, Third Party Advisory
• https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdfIssue Tracking, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1072681Issue Tracking, Patch, Third Party Advisory
• https://github.com/hawtio/hawtio/commit/b4e23e002639c274a2f687ada980118512f06113Issue Tracking, Patch, Third Party Advisory
• https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdfIssue Tracking, Third Party Advisory

Published

Dec 29, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-0114Apache Commons BeanUtils, as distributed in lib/commons-bean…
• CVE-2014-0115Directory traversal vulnerability in the log viewer in Apach…
• CVE-2014-0116CookieInterceptor in Apache Struts 2.x before 2.3.20, when a…
• CVE-2014-0117The mod_proxy module in the Apache HTTP Server 2.4.x before …
• CVE-2014-0118The deflate_in_filter function in mod_deflate.c in the mod_d…
• CVE-2014-0119Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x befo…
• CVE-2014-0121The admin terminal in Hawt.io does not require authenticatio…
• CVE-2014-0122mod/chat/chat_ajax.php in Moodle through 2.3.11, 2.4.x befor…
• CVE-2014-0123The wiki subsystem in Moodle through 2.3.11, 2.4.x before 2.…
• CVE-2014-0124The identity-reporting implementations in mod/forum/renderer…
• CVE-2014-0125repository/alfresco/lib.php in Moodle through 2.3.11, 2.4.x …
• CVE-2014-0126Cross-site request forgery (CSRF) vulnerability in enrol/ims…