Description

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the plain editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

Remediation

References

https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10090

Related Vulnerabilities

CVE-2019-10431 Vulnerability in maven package org.jenkins-ci.plugins:script-security

CVE-2020-24590 Vulnerability in maven package org.wso2.carbon.governance:org.wso2.carbon.governance.generic

CVE-2023-49145 Vulnerability in maven package org.apache.nifi:nifi-jolt-transform-json-ui

CVE-2015-5346 Vulnerability in maven package org.apache.tomcat:tomcat-catalina

CVE-2012-3544 Vulnerability in maven package org.apache.tomcat:tomcat-coyote

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Vendor Advisory