XSS Vulnerability in JavaMelody Monitoring Tool
CVE-2018-12432

6.1MEDIUM

Key Information:

Vendor

Javamelody Project

Status
Javamelody
Vendor
CVE Published:
14 June 2018

What is CVE-2018-12432?

JavaMelody versions up to 1.60.0 are susceptible to a Cross-Site Scripting (XSS) vulnerability through the 'counter' parameter in the clear_counter action on the /monitoring endpoint. This flaw can be exploited by an attacker to inject malicious scripts, which may lead to unauthorized access or manipulation of user data. It is crucial for users of JavaMelody to implement security measures to mitigate potential attacks detailed in the references.

References

https://github.com/Hurdano/JavaMelody-XSS/wiki/Attack-Vec...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.