Lucene search

RedhatCVE-2013-4378

HistorySep 30, 2013 - 10:55 p.m.

CVE-2013-4378

2013-09-3022:55:02

CWE-79

redhat

web.nvd.nist.gov

cve-2013-4378

cross-site scripting

xss

htmlsessioninformationsreport.java

javamelody 1.46

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.8

Confidence

High

EPSS

0.002

Percentile

65.1%

JSON

Cross-site scripting (XSS) vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted X-Forwarded-For header.

Affected configurations

Nvd

Node

emeric_vernatjavamelodyRange≤1.46

emeric_vernatjavamelodyMatch1.6

emeric_vernatjavamelodyMatch1.7

emeric_vernatjavamelodyMatch1.8

emeric_vernatjavamelodyMatch1.9

emeric_vernatjavamelodyMatch1.10

emeric_vernatjavamelodyMatch1.11

emeric_vernatjavamelodyMatch1.12

emeric_vernatjavamelodyMatch1.13

emeric_vernatjavamelodyMatch1.14

emeric_vernatjavamelodyMatch1.15

emeric_vernatjavamelodyMatch1.16

emeric_vernatjavamelodyMatch1.17

emeric_vernatjavamelodyMatch1.18

emeric_vernatjavamelodyMatch1.19

emeric_vernatjavamelodyMatch1.20

emeric_vernatjavamelodyMatch1.21

emeric_vernatjavamelodyMatch1.22

emeric_vernatjavamelodyMatch1.23

emeric_vernatjavamelodyMatch1.24

emeric_vernatjavamelodyMatch1.25

emeric_vernatjavamelodyMatch1.26

emeric_vernatjavamelodyMatch1.27

emeric_vernatjavamelodyMatch1.28

emeric_vernatjavamelodyMatch1.29

emeric_vernatjavamelodyMatch1.30

emeric_vernatjavamelodyMatch1.31

emeric_vernatjavamelodyMatch1.32

emeric_vernatjavamelodyMatch1.32.1

emeric_vernatjavamelodyMatch1.33

emeric_vernatjavamelodyMatch1.34

emeric_vernatjavamelodyMatch1.35

emeric_vernatjavamelodyMatch1.36

emeric_vernatjavamelodyMatch1.37

emeric_vernatjavamelodyMatch1.38

emeric_vernatjavamelodyMatch1.39

emeric_vernatjavamelodyMatch1.40

emeric_vernatjavamelodyMatch1.41

emeric_vernatjavamelodyMatch1.42

emeric_vernatjavamelodyMatch1.43

emeric_vernatjavamelodyMatch1.44

emeric_vernatjavamelodyMatch1.45

VendorProductVersionCPE
emeric_vernatjavamelody*cpe:2.3:a:emeric_vernat:javamelody:*:*:*:*:*:*:*:*
emeric_vernatjavamelody1.6cpe:2.3:a:emeric_vernat:javamelody:1.6:*:*:*:*:*:*:*
emeric_vernatjavamelody1.7cpe:2.3:a:emeric_vernat:javamelody:1.7:*:*:*:*:*:*:*
emeric_vernatjavamelody1.8cpe:2.3:a:emeric_vernat:javamelody:1.8:*:*:*:*:*:*:*
emeric_vernatjavamelody1.9cpe:2.3:a:emeric_vernat:javamelody:1.9:*:*:*:*:*:*:*
emeric_vernatjavamelody1.10cpe:2.3:a:emeric_vernat:javamelody:1.10:*:*:*:*:*:*:*
emeric_vernatjavamelody1.11cpe:2.3:a:emeric_vernat:javamelody:1.11:*:*:*:*:*:*:*
emeric_vernatjavamelody1.12cpe:2.3:a:emeric_vernat:javamelody:1.12:*:*:*:*:*:*:*
emeric_vernatjavamelody1.13cpe:2.3:a:emeric_vernat:javamelody:1.13:*:*:*:*:*:*:*
emeric_vernatjavamelody1.14cpe:2.3:a:emeric_vernat:javamelody:1.14:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
emeric_vernat	javamelody	*	cpe:2.3:a:emeric_vernat:javamelody::::::::
emeric_vernat	javamelody	1.6	cpe:2.3:a:emeric_vernat:javamelody:1.6:::::::*
emeric_vernat	javamelody	1.7	cpe:2.3:a:emeric_vernat:javamelody:1.7:::::::*
emeric_vernat	javamelody	1.8	cpe:2.3:a:emeric_vernat:javamelody:1.8:::::::*
emeric_vernat	javamelody	1.9	cpe:2.3:a:emeric_vernat:javamelody:1.9:::::::*
emeric_vernat	javamelody	1.10	cpe:2.3:a:emeric_vernat:javamelody:1.10:::::::*
emeric_vernat	javamelody	1.11	cpe:2.3:a:emeric_vernat:javamelody:1.11:::::::*
emeric_vernat	javamelody	1.12	cpe:2.3:a:emeric_vernat:javamelody:1.12:::::::*
emeric_vernat	javamelody	1.13	cpe:2.3:a:emeric_vernat:javamelody:1.13:::::::*
emeric_vernat	javamelody	1.14	cpe:2.3:a:emeric_vernat:javamelody:1.14:::::::*

Rows per page:

1-10 of 421

References

osvdb.org/97778

seclists.org/oss-sec/2013/q3/679

www.securityfocus.com/bid/62679

code.google.com/p/javamelody/issues/detail?id=346

code.google.com/p/javamelody/source/detail?r=3515

code.google.com/p/javamelody/wiki/ReleaseNotes

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.8

Confidence

High

EPSS

0.002

Percentile

65.1%

JSON

Related for CVE-2013-4378