GitHub Advisoryadvisory · Maven

GHSA-p4mx-p49m-8rw4 Improper Neutralization of Input During Web Page Generation in JavaMelody

MEDIUM Published 2022-05-17 Modified 2024-03-05 Official page ↗
Aliases
CVE-2013-4378
Ecosystem
Maven
Packages
net.bull.javamelody:javamelody-core
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2022-07-07

Affected packages

• Maven net.bull.javamelody:javamelody-core: < 1.47.0 → fixed in 1.47.0

Description

Cross-site scripting (XSS) vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted X-Forwarded-For header.

Related

Alias · CVE (1)

  • CVE-2013-4378 Cross-site scripting (XSS) vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References