PT-2017-9772 · Apache · Apache Brooklyn

Toshitsugu Yoneyama · Publicado 2017-09-13 · Atualizado 2022-05-17 · CVE-2016-8737

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Brooklyn versions prior to 0.10.0

Description The issue allows a malicious web site to produce a link that, if clicked while a user is logged in, could cause the server to execute the attacker's commands as the user. This is due to the REST server being vulnerable to cross-site request forgery (CSRF). A proof-of-concept exploit using this issue is known to exist.

Recommendations For versions prior to 0.10.0, update to version 0.10.0 or later to resolve the issue. As a temporary workaround, consider implementing CSRF protection mechanisms, such as token-based validation, to minimize the risk of exploitation. Restrict access to sensitive operations within the REST server to minimize potential damage until the update can be applied.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2016-8737

GHSA-G2HF-G7FH-VG92

Produtos afetados

Apache Brooklyn

Referências · 9

• 🔥 https://lists.apache.org/thread.html/877813aaaa0e636adbc36106b89a54e0e6918f0884e9c8b67d5d5953@%3Cdev.brooklyn.apache.org%3E · Exploit
• https://github.com/apache/brooklyn-server/pull/430 · Nota
• https://github.com/apache/brooklyn-ui/pull/37 · Nota
• http://securityfocus.com/bid/96228 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-8737 · Nota de Segurança
• https://lists.apache.org/thread.html/877813aaaa0e636adbc36106b89a54e0e6918f0884e9c8b67d5d5953%40%3Cdev.brooklyn.apache.org%3E · Nota
• https://osv.dev/vulnerability/GHSA-g2hf-g7fh-vg92 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-8737 · Aviso do Fabricante
• https://brooklyn.apache.org/community/security/CVE-2016-8737.html · Aviso do Fabricante