CVE-2013-4378: Cross-site scripting (XSS) vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earli...

Security readout for executives and security teams

JavaMelody 1.46 and earlier can expose users of its monitoring reports to cross-site scripting through a crafted X-Forwarded-For header. The main business risk is compromise of a browser session for someone viewing JavaMelody session information, especially an administrator. This is not described as direct server code execution. Exposure is likely limited to Java applications using JavaMelody 1.46 or earlier and allowing users or administrators to view affected session information reports. Risk increases when the JavaMelody interface is reachable from untrusted networks or reverse proxy headers can be influenced by clients. Prioritize remediation where JavaMelody is exposed beyond trusted admin networks or used by privileged operators. For internal-only, authenticated monitoring, handle in the normal vulnerability cycle, but do not ignore it because XSS against admin tools can support account compromise. Mitigation focus: Identify any JavaMelody deployments and their versions.; Upgrade from JavaMelody 1.46 or earlier following vendor release guidance.; Restrict JavaMelody monitoring access to trusted administrators only..

Prepared

Jun 14, 2026, 15:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.