GHSA-h975-r69h-4w9p
Suggest an improvement- Source
- https://github.com/advisories/GHSA-h975-r69h-4w9p
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-h975-r69h-4w9p/GHSA-h975-r69h-4w9p.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-h975-r69h-4w9p
- Aliases
-
- CVE-2022-32533
- Published
- 2022-07-07T00:00:28Z
- Modified
- 2023-11-08T04:09:36.825519Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Insufficient user input in Apache Jetspeed-2
- Details
-
* UNSUPPORTED WHEN ASSIGNED * Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant project of Apache Portals and no updates will be provided for this issue.
- Database specific
{ "nvd_published_at": "2022-07-06T10:15:00Z", "github_reviewed_at": "2022-07-08T17:57:13Z", "severity": "CRITICAL", "github_reviewed": true, "cwe_ids": [ "CWE-352", "CWE-611", "CWE-79", "CWE-918" ] }- References
Affected packages
Maven / org.apache.portals.jetspeed-2:jetspeed-commons
Package
- Name
- org.apache.portals.jetspeed-2:jetspeed-commons
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.portals.jetspeed-2/jetspeed-commons