GitHub Advisoryadvisory · Maven

GHSA-h975-r69h-4w9p Insufficient user input in Apache Jetspeed-2

CRITICAL Published 2022-07-07 Modified 2022-07-15 Official page ↗
Aliases
CVE-2022-32533
Ecosystem
Maven
Packages
org.apache.portals.jetspeed-2:jetspeed-commons
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-352, CWE-611, CWE-79, CWE-918
Reviewed
2022-07-08

Affected packages

• Maven org.apache.portals.jetspeed-2:jetspeed-commons: <= 2.3.1 (no fix yet)

Description

UNSUPPORTED WHEN ASSIGNED Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant project of Apache Portals and no updates will be provided for this issue.

Related

Alias · CVE (1)

  • CVE-2022-32533 Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and… vulnerability

Weakness · CWE (4)

  • CWE-352 Cross-Site Request Forgery weakness
  • CWE-611 Improper Restriction of XML External Entity Reference weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-918 Server-Side Request Forgery weakness

References