GitHub Advisoryadvisory · Maven

GHSA-gwfq-qwmp-x9xg Cross-site scripting in Apache JSPWiki

MEDIUM Published 2019-10-11 Modified 2021-08-17 Official page ↗
Aliases
CVE-2019-10087
Ecosystem
Maven
Packages
org.apache.jspwiki:jspwiki-war
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2019-09-25

Affected packages

• Maven org.apache.jspwiki:jspwiki-war: >= 2.9.0, < 2.11.0.M5 → fixed in 2.11.0.M5

Description

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Page Revision History, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

Related

Alias · CVE (1)

  • CVE-2019-10087 On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References