GitHub Advisoryadvisory · Maven

GHSA-g2hf-g7fh-vg92 Apache Brooklyn is vulnerable to cross-site request forgery (CSRF)

HIGH Published 2022-05-17 Modified 2025-04-22 Official page ↗
Aliases
CVE-2016-8737
Ecosystem
Maven
Packages
org.apache.brooklyn:brooklyn-rest-resources, org.apache.brooklyn:brooklyn-jsgui
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2025-04-22

Affected packages

• Maven org.apache.brooklyn:brooklyn-rest-resources: < 0.10.0 → fixed in 0.10.0 • Maven org.apache.brooklyn:brooklyn-jsgui: < 0.10.0 → fixed in 0.10.0

Description

In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site request forgery (CSRF), which could permit a malicious web site to produce a link which, if clicked whilst a user is logged in to Brooklyn, would cause the server to execute the attacker's commands as the user. There is known to be a proof-of-concept exploit using this vulnerability.

Related

Alias · CVE (1)

  • CVE-2016-8737 In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site request forgery (CSRF), which could permit a malicious web… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References