GitHub Advisoryadvisory · Maven

GHSA-rrff-chj9-w4c7 Apache JSPWiki Cross-Site Scripting (XSS) Vulnerability via Header Link Rendering

MEDIUM Published 2025-07-31 Modified 2025-11-05 Official page ↗
Aliases
CVE-2025-24853
Ecosystem
Maven
Packages
org.apache.jspwiki:jspwiki-main, org.apache.jspwiki:jspwiki-markdown
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weaknesses
CWE-79
Reviewed
2025-07-31

Affected packages

• Maven org.apache.jspwiki:jspwiki-main: < 2.12.3 → fixed in 2.12.3 • Maven org.apache.jspwiki:jspwiki-markdown: < 2.12.3 → fixed in 2.12.3

Description

A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Further research by the JSPWiki team showed that the markdown parser allowed this kind of attack too. Apache JSPWiki users should upgrade to 2.12.3 or later.

Related

Alias · CVE (1)

  • CVE-2025-24853 A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References