GHSA-cfqj-9g2g-w7q6

ghsaUSosv

Apache JSPWiki Cross-site Scripting due to carefully crafted plugin link invocation

view advisory published 2021-12-02Licence: CC-BY-4.0

A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.0 or later.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-40369US	medium6.1	3.42% (89th)	—	2021-11-24
A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which could allow the attacker to execute javascrip…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2022/08/03/3WEB
https://github.com/apache/jspwikiPACKAGE
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2021-40369WEB
https://lists.apache.org/thread/r2j00nrnpjgcmoxvlv3pgfoq9kzrcsfhWEB
https://nvd.nist.gov/vuln/detail/CVE-2021-40369ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan