GitHub Advisoryadvisory · Maven

GHSA-hp5r-mhgp-56c9 Cross-site Scriptin in JSPWiki

MEDIUM Published 2019-06-06 Modified 2021-08-04 Official page ↗
Aliases
CVE-2019-10078
Ecosystem
Maven
Packages
org.apache.jspwiki:jspwiki-war, org.apache.jspwiki:jspwiki-main
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2019-05-29

Affected packages

• Maven org.apache.jspwiki:jspwiki-war: >= 2.9.0, < 2.11.0.M4 → fixed in 2.11.0.M4 • Maven org.apache.jspwiki:jspwiki-main: >= 2.9.0, < 2.11.0.M4 → fixed in 2.11.0.M4

Description

A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable.

Related

Alias · CVE (1)

  • CVE-2019-10078 A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References