GitHub Advisoryadvisory · Maven

GHSA-72ww-4rcw-mc62 Apache JSPWiki Cross-Site Scripting (XSS) Vulnerability in the Image Plugin

MEDIUM Published 2025-07-31 Modified 2025-11-05 Official page ↗
Aliases
CVE-2025-24854
Ecosystem
Maven
Packages
org.apache.jspwiki:jspwiki-main
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weaknesses
CWE-79
Reviewed
2025-07-31

Affected packages

• Maven org.apache.jspwiki:jspwiki-main: < 2.12.3 → fixed in 2.12.3

Description

A carefully crafted request using the Image plugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.3 or later.

Related

Alias · CVE (1)

  • CVE-2025-24854 A carefully crafted request using the Image plugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References