Improper Neutralization of Input During Web Page Generation in JAMon

MOYENNE 4.3CVE-2013-6235 · GHSA-qpr7-5m63-hq2c · Published 31/01/2014 · updated 17/06/2026

En bref

CVE-2013-6235 est une vulnérabilité MOYENNE (CVSS 4.3) touchant com.jamonapi:jamon, java application monitor (steve souza).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.2%, plus élevée que 82.9% des vulnérabilités.
Correctif : mettre à jour vers 2.80 ou plus récent.

Package	Affected versions	Patched versions
com.jamonapi:jamon Maven	`< 2.80`	`2.80`
java application monitor steve_souza	`= 1.0= 1.01= 2.0= 2.1= 2.2= 2.3= 2.4= 2.5= 2.6≤ 2.7`	No fix yet

Description

Multiple cross-site scripting (XSS) vulnerabilities in JAMon (Java Application Monitor) 2.7 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) listenertype or (2) currentlistener parameter to mondetail.jsp or ArraySQL parameter to (3) mondetail.jsp, (4) jamonadmin.jsp, (5) sql.jsp, or (6) exceptions.jsp.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2013-6235 · ADVISORY
exchange.xforce.ibmcloud.com/vulnerabilities/90699 · WEB
osvdb.org/102570 · WEB
osvdb.org/102571 · WEB
osvdb.org/102572 · WEB
osvdb.org/102573 · WEB
packetstormsecurity.com/files/124933 · WEB
seclists.org/fulldisclosure/2014/Jan/164 · WEB
securityfocus.com/archive/1/530877/100/0/threaded · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free