CVE-2017-3165 Cross-site Scripting In Apache Brooklyn
An authenticated user can execute scripts in another user's browser via improper escaping, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-3165?
CVE-2017-3165 is a medium-severity cross-site scripting vulnerability in Apache Brooklyn, published on 13 Sep 2017. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site scripting where one authenticated user can cause scripts to run in the browser of another user authorized to access the first user's resources. This is due to improper escaping of server-side content. There is known to be a proof-of-concept exploit using this vulnerability.
Weakness: CWE-79
Which versions are affected by CVE-2017-3165?
2 open source packages ship an affected version, including org.apache.brooklyn:brooklyn. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.brooklyn:brooklyn Maven | All versions | 0.10.0 |
org.apache.brooklyn:brooklyn Maven | All versions | 0.10.0 |
Products include Apache Brooklyn.
How do I fix CVE-2017-3165?
Upgrade org.apache.brooklyn:brooklyn to 0.10.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2017-3165 being exploited?
There is no known exploitation of CVE-2017-3165 in the wild and no public exploit code.
Other vulnerabilities in Apache Brooklyn
Sources
Also known as GHSA-j3g9-3fvv-gqfp.