GHSA-hp5r-mhgp-56c9

Source

https://github.com/advisories/GHSA-hp5r-mhgp-56c9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-hp5r-mhgp-56c9/GHSA-hp5r-mhgp-56c9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hp5r-mhgp-56c9

Aliases

CVE-2019-10078

Published

2019-06-06T15:29:29Z

Modified

2023-11-08T04:00:39.739762Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Cross-site Scriptin in JSPWiki

Details

A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable.

Database specific

{
    "nvd_published_at": "2019-05-20T21:29:00Z",
    "github_reviewed_at": "2019-05-29T19:05:49Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-79"
    ]
}

References

Affected packages

Maven / org.apache.jspwiki:jspwiki-war

Package

Name: org.apache.jspwiki:jspwiki-war; View open source insights on deps.dev
Purl: pkg:maven/org.apache.jspwiki/jspwiki-war

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.9.0

Fixed

2.11.0.M4

Affected versions

2.*

2.10.0

2.10.1

2.10.2

2.10.3

2.10.4

2.10.5

2.11.0.M1

2.11.0.M2

2.11.0.M3

Database specific

{
    "last_known_affected_version_range": "<= 2.11.0.M3"
}

Maven / org.apache.jspwiki:jspwiki-main