CVE-2017-3165

State: Published
Severity: Not scored
Published: Sep 13, 2017
Updated: Sep 16, 2024
Reserved: Dec 5, 2016

Description

In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site scripting where one authenticated user can cause scripts to run in the browser of another user authorized to access the first user's resources. This is due to improper escaping of server-side content. There is known to be a proof-of-concept exploit using this vulnerability.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Apache BrooklynApache Software Foundation	0.9.0 and all prior versionsAffected

References

96228vdb-entry
https://brooklyn.apache.org/community/security/CVE-2017-3165.html
[dev] 20170210 [SECURITY] CVE-2017-3165: Cross-site vulnerabilities in Apache Brooklynmailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.