GHSA-h975-r69h-4w9p

Source

https://github.com/advisories/GHSA-h975-r69h-4w9p

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-h975-r69h-4w9p/GHSA-h975-r69h-4w9p.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-h975-r69h-4w9p

Aliases

CVE-2022-32533

Published

2022-07-07T00:00:28Z

Modified

2023-11-08T04:09:36.825519Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Insufficient user input in Apache Jetspeed-2

Details

** UNSUPPORTED WHEN ASSIGNED ** Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant project of Apache Portals and no updates will be provided for this issue.

Database specific

{
    "cwe_ids": [
        "CWE-352",
        "CWE-611",
        "CWE-79",
        "CWE-918"
    ],
    "severity": "CRITICAL",
    "github_reviewed_at": "2022-07-08T17:57:13Z",
    "github_reviewed": true,
    "nvd_published_at": "2022-07-06T10:15:00Z"
}

References

Affected packages

Maven / org.apache.portals.jetspeed-2:jetspeed-commons

Package

Name: org.apache.portals.jetspeed-2:jetspeed-commons; View open source insights on deps.dev
Purl: pkg:maven/org.apache.portals.jetspeed-2/jetspeed-commons

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

2.3.1

Affected versions

2.*

2.0

2.1.3

2.1.4

2.2.0

2.2.1

2.2.2

2.3.0

2.3.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-h975-r69h-4w9p/GHSA-h975-r69h-4w9p.json"