CVE-2016-8737 Apache Brooklyn is vulnerable to cross-site request forgery (CSRF)
HighCVSS 8.8
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site request forgery (CSRF), which could permit a malicious web site to produce a link which, if clicked whilst a user is logged in to Brooklyn, would cause the server to execute the attacker's commands as the user. There is known to be a proof-of-concept exploit using this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.brooklyn/brooklyn-rest-resources(Maven) | < 0.10.0 | 0.10.0 |
| org.apache.brooklyn/brooklyn-rest-resources(Maven) | = 0.9.0 | No fix listed |
| org.apache.brooklyn/brooklyn-jsgui(Maven) | < 0.10.0 | 0.10.0 |
| org.apache.brooklyn/brooklyn-jsgui(Maven) | = 0.7.0-incubating | No fix listed |
| org.apache.brooklyn/brooklyn-jsgui(Maven) | = 0.8.0-incubating | No fix listed |
| org.apache.brooklyn/brooklyn-jsgui(Maven) | = 0.9.0 | No fix listed |
| apache brooklyn | <= 0.9.0 | No fix listed |
| Apache Brooklyn | = 0.9.0 and all prior versions | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- brooklyn.apache.org mitigation patch vendor-advisory
- [dev] 20170210 [SECURITY] CVE-2016-8737: Cross-site request forgery vulnerability in Apache Brooklyn mailing-list
- 96228 third-party-advisory vdb-entry
- github.com