GitHub Advisoryadvisory · Maven

GHSA-g6ww-2x43-h963 Cross-site scripting in Apache JSPWiki

MEDIUM Published 2019-10-11 Modified 2021-08-17 Official page ↗
Aliases
CVE-2019-10090
Ecosystem
Maven
Packages
org.apache.jspwiki:jspwiki-war
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2019-09-25

Affected packages

• Maven org.apache.jspwiki:jspwiki-war: >= 2.9.0, < 2.11.0.M5 → fixed in 2.11.0.M5

Description

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the plain editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

Related

Alias · CVE (1)

  • CVE-2019-10090 On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References