Description

A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.3 or later.

Remediation

References

https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732

Related Vulnerabilities

CVE-2019-3868 Vulnerability in maven package org.keycloak:keycloak-services

CVE-2022-36902 Vulnerability in maven package com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter

CVE-2014-2062 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2023-27905 Vulnerability in maven package org.jenkins-ci:update-center2

CVE-2013-2160 Vulnerability in maven package org.apache.cxf:apache-cxf

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Vendor Advisory