{"id":"CVE-2016-20102","kind":"vulnerability","aliases":["CVE-2016-20102"],"related":[],"title":"JavaMelody: reflected XSS in graph parameter runs script in browsers","description":"JavaMelody before 1.60.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted values in the graph parameter of /monitoring?part=graph. Attackers can include a closing script tag in the graph value, which is only JavaScript-escaped in HtmlCounterReport, to execute script in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.","summary":"JavaMelody, a Java application monitoring library, fails to escape a closing script tag in the graph parameter of /monitoring?part=graph. An attacker who gets a victim to open a crafted link runs script in the victim's browser, and no login is needed to send the request.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","javamelody","package","self-hosted"],"not_affected_if":["javamelody-at-1.60.0-or-later"],"how_to_check":"- Check the JavaMelody version in the application's dependencies, for example `javamelody-core` in `pom.xml` or the Gradle file, and look for any version below `1.60.0`\n- Look for the monitoring path `/monitoring` in the deployed application, which is where the reflected parameter is handled\n- unknown for whether the endpoint is exposed to the internet","fix":"- Upgrade JavaMelody to `1.60.0` or later\n- Until upgraded, restrict access to the `/monitoring` path to trusted networks or staff","status":"open","published_at":"2026-10-20T21:17:13+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T04:04:00+00:00","updated_at":"2026-10-25T04:04:00+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:04:00Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade JavaMelody to `1.60.0` or later\n- Until upgraded, restrict access to the `/monitoring` path to trusted networks or staff","reach":"internet","title":"JavaMelody: reflected XSS in graph parameter runs script in browsers","impact":"medium","summary":"JavaMelody, a Java application monitoring library, fails to escape a closing script tag in the graph parameter of /monitoring?part=graph. An attacker who gets a victim to open a crafted link runs script in the victim's browser, and no login is needed to send the request.","category":"package","nicknames":[],"who_cares":["java","javamelody","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"script runs in a victim's browser session on the monitored app","analyst_note":"Confirm the exact endpoint exposure and whether the monitoring page is commonly exposed; NVD link is the only source given.","how_to_check":"- Check the JavaMelody version in the application's dependencies, for example `javamelody-core` in `pom.xml` or the Gradle file, and look for any version below `1.60.0`\n- Look for the monitoring path `/monitoring` in the deployed application, which is where the reflected parameter is handled\n- unknown for whether the endpoint is exposed to the internet","needs_analyst":true,"not_affected_if":["javamelody-at-1.60.0-or-later"],"who_is_affected":"Applications that bundle JavaMelody before `1.60.0` and serve its /monitoring page are exposed, since the flaw is in the graph parameter that page reads. Teams that do not use JavaMelody, or run a version at or above `1.60.0`, can skip it. Whether the page is reachable from outside the network is unknown from the sources.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000661,"input_tokens":3383,"output_tokens":645,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-10':137C '-18':138C '-20102':13A,16A '-2016':12A,15A '/monitoring':41B,98C '1.60.0':73C '2023':136C 'allow':83C 'applic':26B 'attack':45B,85C,101C 'browser':10A,61B,125C 'close':33B,105C 'contain':74C 'craft':53B,91C 'cross':78C 'cross-sit':77C 'cve':11A,14A 'escap':31B,117C 'evid':127C 'execut':121C 'exploit':126C 'fail':29B 'first':129C 'foundat':134C 'get':47B 'graph':5A,38B,43B,95C,100C,110C 'host':22B 'htmlcounterreport':119C 'includ':103C 'inject':87C 'java':17B,25B 'javamelodi':1A,18B,23B,71C 'javascript':116C 'javascript-escap':115C 'librari':28B 'link':54B 'login':64B 'monitor':27B 'need':66B 'observ':130C 'open':51B 'packag':19B 'paramet':6A,39B,96C 'part':42B,99C 'reflect':2A,76C 'request':70B 'run':7A,55B 'script':8A,34B,56B,80C,88C,106C,122C 'self':21B 'self-host':20B 'send':68B 'shadowserv':133C 'site':79C 'suppli':90C 'tag':35B,107C 'unauthent':84C 'valu':92C,111C 'victim':49B,59B,124C 'vulner':81C 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Applications that bundle JavaMelody before `1.60.0` and serve its /monitoring page are exposed, since the flaw is in the graph parameter that page reads. Teams that do not use JavaMelody, or run a version at or above `1.60.0`, can skip it. Whether the page is reachable from outside the network is unknown from the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2016-20102","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-20102","severity":null,"published_at":"2026-10-20T21:17:13+00:00","modified_at":"2026-10-22T17:40:46+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}