CVE-2013-4378
Improper Neutralization of Input During Web Page Generation in JavaMelody
Cross-site scripting (XSS) vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted X-Forwarded-For header.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted X-Forwarded-For header.
- Record
CVE-2013-4378- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted X-Forwarded-For header.
- Record
CVE-2013-4378- Updated
- 2026-11-02
EUVDEUVD-2022-4676 No score
Cross-site scripting (XSS) vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted X-Forwarded-For header.
- Record
EUVD-2022-4676- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p4mx-p49m-8rw4 No score
Improper Neutralization of Input During Web Page Generation in JavaMelody
Cross-site scripting (XSS) vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted X-Forwarded-For header.
- Record
GHSA-p4mx-p49m-8rw4- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-p4mx-p49m-8rw4 No score
Improper Neutralization of Input During Web Page Generation in JavaMelody
Cross-site scripting (XSS) vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted X-Forwarded-For header.
- Record
GHSA-p4mx-p49m-8rw4- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
net.bull.javamelody:javamelody-coreMaven |
before 1.47.0 | 1.47.0 |
net.bull.javamelody:javamelody-coreMaven |
before 1.47.0, plus listed versions 1.10.01.11.01.11.11.12.01.13.0 Show 39 moreShow less1.14.01.15.01.16.01.16.11.17.01.18.01.19.01.20.01.21.01.22.01.23.01.25.01.26.01.27.01.28.01.29.01.29.11.30.01.31.01.32.01.32.11.33.01.34.01.35.01.36.01.37.01.38.01.39.01.40.01.41.01.42.01.43.01.44.01.45.01.46.01.8.11.8.21.9.01.9.3 |
1.47.0 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | epicosy/VUL4J-50 | 2024-05-31 |
| PoC in GitHub | theratpack/grails-javamelody-sample-app | 2013-10-16 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4378 is a medium vulnerability (CVSS 4.3) in Emeric Vernat Javamelody, published September 30, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.76%, the 86th percentile. Fixed in net.bull.javamelody:javamelody-core 1.47.0.