GHSA-hp5r-mhgp-56c9

ghsaUSosv

Cross-site Scriptin in JSPWiki

view advisory published 2019-06-06Licence: CC-BY-4.0

A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-10078US	medium6.1	4.94% (92nd)	Exploit	2019-05-20
A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicat…

references

External citations — patches, advisories, analysis.

https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10078WEB
https://nvd.nist.gov/vuln/detail/CVE-2019-10078ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan