GitHub Advisoryadvisory · Maven

GHSA-j3g9-3fvv-gqfp Cross-site Scripting In Apache Brooklyn

MEDIUM Published 2022-05-17 Modified 2022-11-01 Official page ↗
Aliases
CVE-2017-3165
Ecosystem
Maven
Packages
org.apache.brooklyn:brooklyn
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-11-01

Affected packages

• Maven org.apache.brooklyn:brooklyn: < 0.10.0 → fixed in 0.10.0

Description

In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site scripting where one authenticated user can cause scripts to run in the browser of another user authorized to access the first user's resources. This is due to improper escaping of server-side content. There is known to be a proof-of-concept exploit using this vulnerability.

Related

Alias · CVE (1)

  • CVE-2017-3165 In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site scripting where one authenticated user can cause scripts to… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References