GHSA-hfpg-gqjw-779m: XSS
Published May 14, 2022
·Updated
An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
Affected Software
1 affected componentFixes available
maven/org.jolokia:jolokia-core>=1.3.7<1.5.0
1.5.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.jolokia:jolokia-coreto a version that resolves this vulnerability.Fixed in 1.5.0
Event History
May 14, 2022
Advisory Published
via GitHub·01:27 AM
Data Sourced
via GitHub·01:27 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What must an attacker do to exploit this issue?
The attacker needs to cause a victim to interact with malicious content, after which the injected JavaScript executes in the victim's browser. No attacker privileges are required, and the vulnerable HTTP servlet is reachable over the network.
2
What is the likely impact if exploitation succeeds?
Successful exploitation can expose or modify information accessible in the victim's browser context. The vulnerability does not indicate a direct availability impact.