CVE-2019-15477: Cross-site Scripting in Jooby
Summary
CVE-2019-15477: Cross-site Scripting in Jooby. Affects org.jooby:jooby versions < 1.6.4. Fixed in 1.6.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jooby is a Java web framework that aims to simplify web development by providing a lightweight and modular architecture. It allows developers to build scalable and performant web applications. The vulnerability identified as CVE-2019-15477 is a cross-site scripting (XSS) vulnerability that affects Jooby versions prior to 1.6.4. XSS is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. In the case of Jooby, the default error handler is susceptible to XSS attacks.
Vulnerability Detail
The XSS vulnerability in Jooby's default error handler can be exploited by an attacker to inject arbitrary scripts or HTML code into error pages. This can lead to various security risks, such as session hijacking, defacement of web pages, or the theft of sensitive user information. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level. The CWE ID associated with this vulnerability is CWE-79, which refers to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
How To Fix
Latest published version: 1.6.9 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The XSS vulnerability in Jooby's default error handler (CVE-2019-15477) can be mitigated by upgrading to version 1.6.4 or later. It is crucial to promptly apply the recommended fix to protect web applications from potential XSS attacks. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jooby:jooby →
FAQ
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts or HTML code into web pages viewed by other users. This can lead to various security risks, such as session hijacking, defacement of web pages, or the theft of sensitive user information.
The XSS vulnerability in Jooby's default error handler allows attackers to inject arbitrary scripts or HTML code into error pages. This can potentially lead to the execution of malicious code in the context of other users' browsers, compromising their session data or exposing them to other security risks.
There is no specific information available regarding known exploits targeting this vulnerability in Jooby's default error handler. However, it is important to promptly apply the recommended fix to mitigate the risk of potential exploitation.
No, only versions of Jooby prior to 1.6.4 are affected by this XSS vulnerability in the default error handler. It is recommended to upgrade to version 1.6.4 or later to address the issue.
No additional configuration changes are required after upgrading Jooby to version 1.6.4 or later. The fix for the XSS vulnerability in the default error handler is included in the patched version, and it should be applied automatically upon upgrading.
