Reflected Cross-Site Scripting Vulnerability in JavaMelody by JavaMelody

CVE-2016-20102

What is CVE-2016-20102?

JavaMelody versions prior to 1.60.0 are susceptible to a reflected cross-site scripting vulnerability. This flaw allows unauthenticated attackers to inject malicious scripts by supplying crafted input in the graph parameter of the monitoring endpoint. Specifically, attackers can include a closing script tag in the graph value, which is only JavaScript-escaped in the HtmlCounterReport, resulting in the execution of arbitrary scripts in the victim's browser. Evidence of exploitation of this vulnerability was first reported by the Shadowserver Foundation on 2023-10-18, highlighting the critical need for users to upgrade to the latest version to mitigate this security risk.

References