mirror of
https://github.com/projectdiscovery/nuclei-templates.git
synced 2026-01-31 15:53:33 +08:00
209538baa6
* info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
28 lines
895 B
YAML
28 lines
895 B
YAML
id: java-melody-exposed
|
|
|
|
info:
|
|
name: JavaMelody Monitoring Exposed
|
|
author: dhiyaneshDK,thomas_from_offensity
|
|
severity: medium
|
|
description: JavaMelody is a tool used to monitor Java or Java EE applications in QA and production environments. JavaMelody was detected on this web application. One option in the dashboard is to "View http sessions".
|
|
This can be used by an attacker to steal a user's session.
|
|
reference:
|
|
- https://www.acunetix.com/vulnerabilities/web/javamelody-publicly-accessible/
|
|
- https://github.com/javamelody/javamelody/wiki/UserGuide#16-security
|
|
tags: config,java,javamelody
|
|
|
|
requests:
|
|
- method: GET
|
|
path:
|
|
- '{{BaseURL}}/monitoring'
|
|
- '{{BaseURL}}/..%3B/monitoring'
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- 'Monitoring JavaMelody on'
|
|
- type: status
|
|
status:
|
|
- 200
|