Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1wMnI0LXJwajgtbTJwOc4AAiHq

Cross-site Scripting in Apache JSPWiki

In Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the remember parameter on some of the JSPs, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

Permalink: https://github.com/advisories/GHSA-p2r4-rpj8-m2p9
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wMnI0LXJwajgtbTJwOc4AAiHq
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: 9 months ago

CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-p2r4-rpj8-m2p9, CVE-2019-12407
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-12407
• https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-12407
• https://github.com/advisories/GHSA-p2r4-rpj8-m2p9

Blast Radius: 8.2

Affected Packages