Cross-site Scripting in JSPWiki

2019-06-0615:29:25

Google

osv.dev

0.004 Low

EPSS

Percentile

75.1%

JSON

A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.

CPENameOperatorVersion
org.apache.jspwiki:jspwiki-wareq2.10.2
org.apache.jspwiki:jspwiki-wareq2.10.3
org.apache.jspwiki:jspwiki-wareq2.10.0
org.apache.jspwiki:jspwiki-wareq2.11.0.M3
org.apache.jspwiki:jspwiki-maineq2.11.0.M1
org.apache.jspwiki:jspwiki-maineq2.11.0.M2
org.apache.jspwiki:jspwiki-wareq2.10.1
org.apache.jspwiki:jspwiki-maineq2.11.0.M3
org.apache.jspwiki:jspwiki-wareq2.10.5
org.apache.jspwiki:jspwiki-wareq2.11.0.M1

Name	Operator	Version
org.apache.jspwiki:jspwiki-war	eq	2.10.2
org.apache.jspwiki:jspwiki-war	eq	2.10.3
org.apache.jspwiki:jspwiki-war	eq	2.10.0
org.apache.jspwiki:jspwiki-war	eq	2.11.0.M3
org.apache.jspwiki:jspwiki-main	eq	2.11.0.M1
org.apache.jspwiki:jspwiki-main	eq	2.11.0.M2
org.apache.jspwiki:jspwiki-war	eq	2.10.1
org.apache.jspwiki:jspwiki-main	eq	2.11.0.M3
org.apache.jspwiki:jspwiki-war	eq	2.10.5
org.apache.jspwiki:jspwiki-war	eq	2.11.0.M1