Cross-Site Request Forgery Vulnerability in Apache Brooklyn REST Server

CVE-2016-8737

What is CVE-2016-8737?

In Apache Brooklyn prior to version 0.10.0, a security vulnerability exists in the REST server that is susceptible to cross-site request forgery (CSRF). This flaw allows malicious websites to craft links capable of executing unwanted commands on the server while a user is logged in. If a user unwittingly clicks on such a link, the attacker's commands may be executed with the user's privileges. A proof-of-concept exploit for this vulnerability is publicly available, underscoring the importance of patching affected versions.

References