Read the docs
TI-2017-02381 Aliases CVE-2017-3165GHSA-j3g9-3fvv-gqfp

Cross-site scripting in Apache Brooklyn

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site scripting where one authenticated user can cause scripts to run in the browser of another user authorized to access the first user's resources. This is due to improper escaping of server-side content. There is known to be a proof-of-concept exploit using this vulnerability.

Why it matters now

EPSS 0.02224 82nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed org.apache.brooklyn:brooklyn (Maven): 0.10.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Brooklyn0.9.0 and all prior versions—No fix listedCNA
—org.apache.brooklyn:brooklyn (Maven)before 0.10.00.10.0Patch availableGHSA-j3g9-3fvv-gqfp
  • Apache Brooklyn VendorApache Affected 0.9.0 and all prior versions Fixed in — No fix listed CNA
  • org.apache.brooklyn:brooklyn (Maven) Vendor— Affected before 0.10.0 Fixed in 0.10.0 Patch available GHSA-j3g9-3fvv-gqfp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:brooklyn:*:*:*:*:*:*:*:*up to 0.9.0VulnerableApache
  • cpe:2.3:a:apache:brooklyn:*:*:*:*:*:*:*:* Versions up to 0.9.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-j3g9-3fvv-gqfp org.apache.brooklyn:brooklyn (Maven) Fixed in 0.10.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-3165
  2. 2026-10-03 Alias added: GHSA-j3g9-3fvv-gqfp

References

Exploit 1

Advisory 1

Other 2

  • TI-2016-07201 Deserialization of untrusted data in Apache Brooklyn CVSS 3.0HIGH 8.8
  • TI-2016-07194 Cross-site request forgery in Apache Brooklyn CVSS 3.0HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences