Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1wMnI0LXJwajgtbTJwOc4AAiHq

Cross-site Scripting in Apache JSPWiki

In Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the remember parameter on some of the JSPs, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

Permalink: https://github.com/advisories/GHSA-p2r4-rpj8-m2p9
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wMnI0LXJwajgtbTJwOc4AAiHq
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: over 1 year ago


CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-p2r4-rpj8-m2p9, CVE-2019-12407
References: Blast Radius: 8.2

Affected Packages

maven:org.apache.jspwiki:jspwiki-main
Dependent packages: 8
Dependent repositories: 20
Downloads:
Affected Version Ranges: < 2.11.0.M5
Fixed in: 2.11.0.M5
All affected versions:
All unaffected versions: 2.11.0, 2.11.1, 2.11.2, 2.11.3, 2.12.0, 2.12.1, 2.12.2
maven:org.apache.jspwiki:jspwiki-war
Dependent packages: 5
Dependent repositories: 22
Downloads:
Affected Version Ranges: < 2.11.0.M5
Fixed in: 2.11.0.M5
All affected versions:
All unaffected versions: 2.10.0, 2.10.1, 2.10.2, 2.10.3, 2.10.4, 2.10.5, 2.11.0, 2.11.1, 2.11.2, 2.11.3, 2.12.0, 2.12.1, 2.12.2