CVE-2016-8737

High

Published: 13/09/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

In Apache Brooklyn before version 0.10.0, the REST server is vulnerable to cross-site request forgery (CSRF), which could allow a malicious website to execute the attacker's commands as the user if clicked while logged in.

Risk Assessment

An attacker could exploit this vulnerability to take control of the user's account, leading to unauthorized access to system resources.

Recommendation

It is recommended to upgrade Apache Brooklyn to version 0.10.0 or later to mitigate this vulnerability.

Other vulnerabilities in Apache Brooklyn

CVE-2016-8744High
Apache Brooklyn before version 0.10.0 uses the SnakeYAML library for parsing YAML data, allowing deserialization to any Java type. In the default configuration, an authenticated user can exploit this vulnerability to execute unauthorized Java code in the context of the Brooklyn process.

Original NVD description (English source)

In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site request forgery (CSRF), which could permit a malicious web site to produce a link which, if clicked whilst a user is logged in to Brooklyn, would cause the server to execute the attacker's commands as the user. There is known to be a proof-of-concept exploit using this vulnerability.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS