Loading...

XML

Word

Printable

Fuse Progress Bar:

% %
Steps to Reproduce:

Hide

1. Open Hawtio;
2. Type "http://localhost:8181/hawtio/users" into URL bar (make sure you are logged out);
3. It will pass you to the Hawtio page;

I believe, there are more URLs which can pass you without authentication. I will investigate it.

Show
1. Open Hawtio; 2. Type "http://localhost:8181/hawtio/users" into URL bar (make sure you are logged out); 3. It will pass you to the Hawtio page; I believe, there are more URLs which can pass you without authentication. I will investigate it.

The issue is also presented in Red Hat Fuse (7.3.1.fuse-731003)

The url http://localhost:8181/hawtio/users allows to get access to Hawtio with limited functionality, of course.

List of URLs which can pass:

The URL - http://localhost:8181/hawtio/user gives the following result

blocks

ENTESB-10681 Build Fuse 7.3.1.CR1

clones

ENTESB-10798 [Hawtio] Direct url gives an access to Hawtio without authentication

is related to

ENTESB-10468 [Hawtio] Direct url gives an access to Hawtio without authentication

ENTESB-7967 Hawtio: direct url passes to the hawtio page without authentication