CVE-2019-10090

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-10090
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-10090.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-10090
Aliases
Published
2019-09-23T16:15:14.647Z
Modified
2026-07-08T18:17:14.170081Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the plain editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

References

Affected packages

Git / github.com/apache/jspwiki

Affected ranges

Type
GIT
Repo
https://github.com/apache/jspwiki
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
1b7f36e1ab997bcdc07f9f27f8ee8f692648411d
Introduced
7d36c03d534201d044b1f5572b08478f681a39d4
Last affected
0a1ec7e139783515220c285be3b1cadfc077745d
Database specific 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.10.5"
        },
        {
            "introduced": "2.11.0-m1"
        },
        {
            "last_affected": "2.11.0-m1"
        },
        {
            "introduced": "2.11.0-m1\\-rc3"
        },
        {
            "last_affected": "2.11.0-m1\\-rc3"
        },
        {
            "introduced": "2.11.0-m1\\-rc1"
        },
        {
            "last_affected": "2.11.0-m1\\-rc1"
        },
        {
            "introduced": "2.11.0-m1\\-rc2"
        },
        {
            "last_affected": "2.11.0-m1\\-rc2"
        },
        {
            "introduced": "2.11.0-m2"
        },
        {
            "last_affected": "2.11.0-m2"
        },
        {
            "introduced": "2.11.0-m2\\-rc1"
        },
        {
            "last_affected": "2.11.0-m2\\-rc1"
        },
        {
            "introduced": "2.11.0-m3"
        },
        {
            "last_affected": "2.11.0-m3"
        },
        {
            "introduced": "2.11.0-m3\\-rc2"
        },
        {
            "last_affected": "2.11.0-m3\\-rc2"
        },
        {
            "introduced": "2.11.0-m3\\-rc1"
        },
        {
            "last_affected": "2.11.0-m3\\-rc1"
        },
        {
            "introduced": "2.11.0-m4"
        },
        {
            "last_affected": "2.11.0-m4"
        },
        {
            "introduced": "2.11.0-m4\\-rc2"
        },
        {
            "last_affected": "2.11.0-m4\\-rc2"
        },
        {
            "introduced": "2.11.0-m4\\-rc1"
        },
        {
            "last_affected": "2.11.0-m4\\-rc1"
        }
    ],
    "cpe": [
        "cpe:2.3:a:apache:jspwiki:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:jspwiki:2.11.0:m1:*:*:*:*:*:*",
        "cpe:2.3:a:apache:jspwiki:2.11.0:m1-rc3:*:*:*:*:*:*",
        "cpe:2.3:a:apache:jspwiki:2.11.0:m1-rc1:*:*:*:*:*:*",
        "cpe:2.3:a:apache:jspwiki:2.11.0:m1-rc2:*:*:*:*:*:*",
        "cpe:2.3:a:apache:jspwiki:2.11.0:m2:*:*:*:*:*:*",
        "cpe:2.3:a:apache:jspwiki:2.11.0:m2-rc1:*:*:*:*:*:*",
        "cpe:2.3:a:apache:jspwiki:2.11.0:m3:*:*:*:*:*:*",
        "cpe:2.3:a:apache:jspwiki:2.11.0:m3-rc2:*:*:*:*:*:*",
        "cpe:2.3:a:apache:jspwiki:2.11.0:m3-rc1:*:*:*:*:*:*",
        "cpe:2.3:a:apache:jspwiki:2.11.0:m4:*:*:*:*:*:*",
        "cpe:2.3:a:apache:jspwiki:2.11.0:m4-rc2:*:*:*:*:*:*",
        "cpe:2.3:a:apache:jspwiki:2.11.0:m4-rc1:*:*:*:*:*:*"
    ]
}

Affected versions

2.*
2.10.3
2.10.3-RC1
2.10.3-RC2
2.10.4
2.10.4-RC1
2.10.4-RC2
2.10.4-RC3
2.10.5
2.10.5-RC1
2.10.5-RC2
2.11.0-m1
2.11.0-m1\-rc1
2.11.0-m1\-rc2
2.11.0-m2
2.11.0-m3
2.11.0-m3\-rc1
2.11.0-m4
2.11.0-m4\-rc1
2.11.0.M1
2.11.0.M1.RC3
2.11.0.M2
2.11.0.M2-RC1
2.11.0.M3
2.11.0.M3-RC1
2.11.0.M3-RC2
2.11.0.M4-RC1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-10090.json"