Description

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the remember parameter on some of the JSPs, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

Remediation

References

https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-12407

Related Vulnerabilities

CVE-2023-29216 Vulnerability in maven package org.apache.linkis:linkis-common

CVE-2020-9482 Vulnerability in maven package org.apache.nifi.registry:nifi-registry-web-api

CVE-2021-33900 Vulnerability in maven package org.apache.directory.studio:org.apache.directory.studio.parent

CVE-2019-1003066 Vulnerability in maven package org.jvnet.hudson.plugins:bugzilla

CVE-2023-28155 Vulnerability in maven package org.webjars.bower:request

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Vendor Advisory