CVE-2016-20102

Received Received - Intake

Reflected XSS in JavaMelody Monitoring Tool

Publication date: 2026-10-20

Last updated on: 2026-10-21

Assigner: VulnCheck

Description

JavaMelody before 1.60.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted values in the graph parameter of /monitoring?part=graph. Attackers can include a closing script tag in the graph value, which is only JavaScript-escaped in HtmlCounterReport, to execute script in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2016-20102

Affected Vendors & Products

Vendor	Product	Version / Range
JavaMelody	JavaMelody	1.8.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in JavaMelody versions before 1.60.0. It allows unauthenticated attackers to inject malicious scripts via the 'graph' parameter in the URL '/monitoring?part=graph'. The injected script executes in victims' browsers due to improper escaping in HtmlCounterReport.

Detection Guidance

To detect this vulnerability, monitor HTTP requests to /monitoring?part=graph with crafted graph parameters. Look for reflected XSS attempts, such as URLs containing script tags or unusual graph values. Use tools like curl to test endpoints: curl -v 'http://target/monitoring?part=graph&graph=<script>alert(1)</script>'

Impact Analysis

Attackers could steal session cookies, redirect users to malicious sites, or perform actions on behalf of users. This could lead to unauthorized access to sensitive data or account compromise if users interact with crafted links.

Compliance Impact

This vulnerability is a reflected cross-site scripting (XSS) flaw that could allow attackers to inject malicious scripts into web pages viewed by users. While it does not directly impact data storage or processing, it could potentially lead to unauthorized access to sensitive data if exploited, which may violate compliance requirements under GDPR or HIPAA depending on the context of use.

Mitigation Strategies

Upgrade JavaMelody to version 1.60.0 or later to address the reflected XSS flaw. If immediate upgrade is not possible, implement input validation for the graph parameter and add output encoding to sanitize user-supplied data. Monitor network traffic for suspicious activity targeting /monitoring endpoints.

Hi! I’m here to help you understand CVE-2016-20102. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...