GitHub Advisoryadvisory · Maven

GHSA-p2r4-rpj8-m2p9 Cross-site Scripting in Apache JSPWiki

MEDIUM Published 2022-05-24 Modified 2023-07-17 Official page ↗
Aliases
CVE-2019-12407
Ecosystem
Maven
Packages
org.apache.jspwiki:jspwiki-war, org.apache.jspwiki:jspwiki-main
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-11-04

Affected packages

• Maven org.apache.jspwiki:jspwiki-war: < 2.11.0.M5 → fixed in 2.11.0.M5 • Maven org.apache.jspwiki:jspwiki-main: < 2.11.0.M5 → fixed in 2.11.0.M5

Description

In Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the remember parameter on some of the JSPs, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

Related

Alias · CVE (1)

  • CVE-2019-12407 On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References