PT-2017-15697 · Apache · Apache Brooklyn

Toshitsugu Yoneyama · Publicado 2017-09-13 · Atualizado 2022-05-17 · CVE-2017-3165

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Brooklyn versions prior to 0.10.0

Description The issue allows one authenticated user to cause scripts to run in the browser of another user authorized to access the first user's resources through cross-site scripting. This is due to improper escaping of server-side content. A proof-of-concept exploit using this vulnerability is known to exist.

Recommendations For versions prior to 0.10.0, update to version 0.10.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive resources to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-3165

GHSA-J3G9-3FVV-GQFP

Produtos afetados

Apache Brooklyn

Referências · 7

• 🔥 https://brooklyn.apache.org/community/security/CVE-2017-3165.html · Exploit
• http://securityfocus.com/bid/96228 · Nota
• https://lists.apache.org/thread.html/5aa6b7583edbfc1f5653607003204326d9e27ef65e8af356c798b21c%40%3Cdev.brooklyn.apache.org%3E · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-3165 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-j3g9-3fvv-gqfp · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-3165 · Aviso do Fabricante
• https://lists.apache.org/thread.html/5aa6b7583edbfc1f5653607003204326d9e27ef65e8af356c798b21c@%3Cdev.brooklyn.apache.org%3E · Nota