GitHub Advisoryadvisory · Maven

GHSA-7qmg-qg53-mrp8 Cross-site scripting in Apache JSPWiki

MEDIUM Published 2019-10-11 Modified 2021-08-17 Official page ↗
Aliases
CVE-2019-12404
Ecosystem
Maven
Packages
org.apache.jspwiki:jspwiki-war
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2019-09-25

Affected packages

• Maven org.apache.jspwiki:jspwiki-war: >= 2.9.0, < 2.11.0.M5 → fixed in 2.11.0.M5

Description

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to InfoContent.jsp, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

Related

Alias · CVE (1)

  • CVE-2019-12404 On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References