{"action":"Upgrade org.apache.brooklyn:brooklyn-jsgui to 0.10.0 or later.","affected":[{"fixed":"0.10.0","introduced":"0"}],"component":"org.apache.brooklyn:brooklyn-jsgui","cve_ids":["CVE-2016-8737"],"ecosystem":"Maven","epss":0.01318,"exploited":false,"fixed_versions":["0.10.0"],"ghsa_id":"GHSA-g2hf-g7fh-vg92","id":"tcs_01M5N8X34CPRZVE4SQDH2FR46M","modified_at":"2025-04-22T22:27:12.725075Z","published_at":"2022-05-17T00:50:35Z","references":["https://osv.dev/vulnerability/GHSA-g2hf-g7fh-vg92","https://nvd.nist.gov/vuln/detail/CVE-2016-8737","https://github.com/apache/brooklyn-server/pull/430","https://github.com/apache/brooklyn-ui/pull/37","https://brooklyn.apache.org/community/security/CVE-2016-8737.html","https://lists.apache.org/thread.html/877813aaaa0e636adbc36106b89a54e0e6918f0884e9c8b67d5d5953%40%3Cdev.brooklyn.apache.org%3E"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-g2hf-g7fh-vg92#Maven/org.apache.brooklyn:brooklyn-jsgui","url":"https://osv.dev/vulnerability/GHSA-g2hf-g7fh-vg92"}],"summary":"Apache Brooklyn is vulnerable to cross-site request forgery (CSRF)"}