PT-2017-15697 · Apache · Apache Brooklyn

Toshitsugu Yoneyama · Published 2017-09-13 · Updated 2022-05-17 · CVE-2017-3165

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Brooklyn versions prior to 0.10.0

Description The issue allows one authenticated user to cause scripts to run in the browser of another user authorized to access the first user's resources through cross-site scripting. This is due to improper escaping of server-side content. A proof-of-concept exploit using this vulnerability is known to exist.

Recommendations For versions prior to 0.10.0, update to version 0.10.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive resources to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-3165

GHSA-J3G9-3FVV-GQFP

Affected Products

Apache Brooklyn

References · 7

• 🔥 https://brooklyn.apache.org/community/security/CVE-2017-3165.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-3165 · Security Note
• https://osv.dev/vulnerability/GHSA-j3g9-3fvv-gqfp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-3165 · Vendor Advisory
• http://securityfocus.com/bid/96228 · Note
• https://lists.apache.org/thread.html/5aa6b7583edbfc1f5653607003204326d9e27ef65e8af356c798b21c%40%3Cdev.brooklyn.apache.org%3E · Note
• https://lists.apache.org/thread.html/5aa6b7583edbfc1f5653607003204326d9e27ef65e8af356c798b21c@%3Cdev.brooklyn.apache.org%3E · Note