CVE-2016-8737: Apache Brooklyn is vulnerable to cross-site request forgery (CSRF)
(updated )
In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site request forgery (CSRF), which could permit a malicious web site to produce a link which, if clicked whilst a user is logged in to Brooklyn, would cause the server to execute the attacker’s commands as the user. There is known to be a proof-of-concept exploit using this vulnerability.
References
- brooklyn.apache.org/community/security/CVE-2016-8737.html
- github.com/advisories/GHSA-g2hf-g7fh-vg92
- github.com/apache/brooklyn-server/pull/430
- github.com/apache/brooklyn-ui/pull/37
- lists.apache.org/thread.html/877813aaaa0e636adbc36106b89a54e0e6918f0884e9c8b67d5d5953%40%3Cdev.brooklyn.apache.org%3E
- nvd.nist.gov/vuln/detail/CVE-2016-8737
Code Behaviors & Features
Detect and mitigate CVE-2016-8737 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →