CVE-2013-4378

Description

Cross-site scripting (XSS) vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted X-Forwarded-For header.

How to fix CVE-2013-4378

To remediate CVE-2013-4378, upgrade the affected package to a fixed version below.

• Maven/net.bull.javamelody:javamelody-core—upgrade to 1.47.0 or later

Is CVE-2013-4378 being exploited?

Low — EPSS is 0.5%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 1.47.0

References (8)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2013-4378
• WEBosvdb.org/97778
• WEBcode.google.com/p/javamelody/issues/detail?id=346
• WEBcode.google.com/p/javamelody/source/detail?r=3515
• WEBcode.google.com