CVE-2016-1000273
Java Melody vulnerable to cross-site scripting
CVE-2016-1000273 is a critical vulnerability (CVSS 10.0) in net.bull.javamelody:javamelody-core, published July 20, 2022. No source lists public exploit code. Fixed in net.bull.javamelody:javamelody-core 1.61.0.
- Severity
- 10.0 CriticalCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.61.0net.bull.javamelody:javamelody-core +1 more
Description
JavaMelody is a monitoring tool for JavaEE applications. Versions prior to 1.61.0 are vulnerable to a cross-site scripting (XSS) attack. This issue was patched in version 1.61.0, and users are recommended to upgrade to the latest version. There are no known workarounds.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected packages
| Package | Affected | Fixed |
|---|---|---|
net.bull.javamelody:javamelody-coreMaven | before 1.61.0 | 1.61.0 |
net.bull.javamelody:javamelody-coreMaven | before 1.61.0, plus listed versions 1.10.01.11.01.11.11.12.01.13.0 Show 45 moreShow less1.14.01.15.01.16.01.16.11.17.01.18.01.19.01.20.01.21.01.22.01.23.01.25.01.26.01.27.01.28.01.29.01.29.11.30.01.31.01.32.01.32.11.33.01.34.01.35.01.36.01.37.01.38.01.39.01.40.01.41.01.42.01.43.01.44.01.45.01.46.01.47.01.48.01.49.01.50.01.51.01.52.01.53.01.54.01.55.01.56.0 | 1.61.0 |
What each source reports
GitHub Advisories Score usedGHSA-cqhr-jqvc-qw9p
Java Melody vulnerable to cross-site scripting
JavaMelody is a monitoring tool for JavaEE applications. Versions prior to 1.61.0 are vulnerable to a cross-site scripting (XSS) attack. This issue was patched in version 1.61.0, and users are recommended to upgrade to the latest version. There are no known workarounds.
- Record
GHSA-cqhr-jqvc-qw9p- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-cqhr-jqvc-qw9p
Java Melody vulnerable to cross-site scripting
JavaMelody is a monitoring tool for JavaEE applications. Versions prior to 1.61.0 are vulnerable to a cross-site scripting (XSS) attack. This issue was patched in version 1.61.0, and users are recommended to upgrade to the latest version. There are no known workarounds.
- Record
GHSA-cqhr-jqvc-qw9p- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
Left out here: 8 versions. The JSON record has them.