Cross-site Scriptin in JSPWiki

2019-06-0615:29:29

Google

osv.dev

0.006 Low

EPSS

Percentile

79.1%

JSON

A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable.

CPENameOperatorVersion
org.apache.jspwiki:jspwiki-wareq2.10.2
org.apache.jspwiki:jspwiki-wareq2.10.3
org.apache.jspwiki:jspwiki-wareq2.10.0
org.apache.jspwiki:jspwiki-wareq2.11.0.M3
org.apache.jspwiki:jspwiki-maineq2.11.0.M1
org.apache.jspwiki:jspwiki-maineq2.11.0.M2
org.apache.jspwiki:jspwiki-wareq2.10.1
org.apache.jspwiki:jspwiki-maineq2.11.0.M3
org.apache.jspwiki:jspwiki-wareq2.10.5
org.apache.jspwiki:jspwiki-wareq2.11.0.M1

Name	Operator	Version
org.apache.jspwiki:jspwiki-war	eq	2.10.2
org.apache.jspwiki:jspwiki-war	eq	2.10.3
org.apache.jspwiki:jspwiki-war	eq	2.10.0
org.apache.jspwiki:jspwiki-war	eq	2.11.0.M3
org.apache.jspwiki:jspwiki-main	eq	2.11.0.M1
org.apache.jspwiki:jspwiki-main	eq	2.11.0.M2
org.apache.jspwiki:jspwiki-war	eq	2.10.1
org.apache.jspwiki:jspwiki-main	eq	2.11.0.M3
org.apache.jspwiki:jspwiki-war	eq	2.10.5
org.apache.jspwiki:jspwiki-war	eq	2.11.0.M1