CVE-2016-20102: JavaMelody < 1.60.0 Reflected XSS via monitoring graph parameter
JavaMelody before 1.60.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted values in the graph parameter of /monitoring?part=graph. Attackers can include a closing script tag in the graph value, which is only JavaScript-escaped in HtmlCounterReport, to execute script in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An unauthenticated attacker can supply a crafted graph parameter to /monitoring?part=graph. Successful exploitation requires a victim to interact with the resulting page or link so that the injected script runs in the victim's browser.
Which deployments should be prioritized for remediation?
Prioritize JavaMelody installations running versions earlier than 1.60.0, particularly where the /monitoring endpoint is reachable by untrusted users. The reported exploit path does not require attacker authentication.
How can I look for attempted exploitation?
Review requests to /monitoring?part=graph and inspect graph parameter values for script-breaking input, such as closing script tags. Exploitation evidence was first observed on 2023-10-18.