CVE-2013-4378

2013-09-3016:00:00

redhat

www.cve.org

javamelody

cross-site scripting

remote attackers

x-forwarded-for

AI Score

5.6

Confidence

High

EPSS

0.002

Percentile

65.1%

JSON

Cross-site scripting (XSS) vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted X-Forwarded-For header.

References

osvdb.org/97778

seclists.org/oss-sec/2013/q3/679

www.securityfocus.com/bid/62679

code.google.com/p/javamelody/issues/detail?id=346

code.google.com/p/javamelody/source/detail?r=3515

code.google.com/p/javamelody/wiki/ReleaseNotes