Security readout for executives and security teams
Plain-English summary
Jolokia agent 1.3.7 has a JNDI injection issue in proxy mode. If reachable, a remote attacker could execute arbitrary Java code on the server. The public record does not provide CVSS scoring or broad affected-product metadata, so prioritize confirmation of Jolokia exposure and vendor guidance.
Executive priority
Prioritize this as urgent for any Jolokia 1.3.7 proxy-mode deployment, especially if externally reachable. The business risk is server compromise, but urgency depends on whether that specific version and mode exist in the environment.
Technical view
The CVE describes JNDI injection in Jolokia agent 1.3.7 when proxy mode is used, leading to remote arbitrary Java code execution. The Jolokia reference points to security fixes with 1.5.0, and Red Hat published RHSA-2018:2669. No KEV listing is provided.
Likely exposure
Exposure is most likely where Jolokia agent 1.3.7 is deployed, proxy mode is enabled, and the agent is reachable by untrusted users or networks.
Exploitation context
The provided sources support remote code execution potential, but do not show active exploitation. The CVE is not marked KEV in the source bundle. Treat internet-facing proxy-mode deployments as urgent until verified.
Researcher notes
The evidence is concise: version 1.3.7, proxy mode, JNDI injection, arbitrary Java code execution. Missing details include CVSS, CWE, complete affected CPEs, and exploit-in-the-wild evidence. Avoid assuming broader product impact without asset confirmation.
Mitigation direction
- Inventory Jolokia agent deployments and versions.
- Check whether Jolokia proxy mode is enabled.
- Review Jolokia 1.5.0 security-fix guidance.
- Apply vendor-supported updates or mitigations from Jolokia or Red Hat.
- Restrict Jolokia access to trusted networks and authenticated users.
Validation and detection
- Confirm no reachable Jolokia 1.3.7 proxy-mode endpoints remain.
- Verify deployed Jolokia versions against vendor guidance.
- Review configuration for proxy mode exposure.
- Check Red Hat advisory applicability for affected packaged deployments.
- Document compensating access controls where upgrades are pending.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-1000130 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://jolokia.org/#Security_fixes_with_1.5.0CVE reference · x_refsource_CONFIRM
- RHSA-2018:2669CVE reference · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.