Cross-Site Scripting Vulnerability in Apache Brooklyn REST Server

CVE-2017-3165

Summary

The Apache Brooklyn REST server, prior to version 0.10.0, is susceptible to a cross-site scripting vulnerability. This flaw allows an authenticated user to execute malicious scripts in the web browsers of other users who have access to the resources of the attacker. The vulnerability arises from inadequate escaping of content generated on the server side, which could potentially lead to unauthorized actions and disclosure of sensitive information. There exists a proof-of-concept exploit that demonstrates the impact of this vulnerability.

References