GHSA-rrff-chj9-w4c7

Source

https://github.com/advisories/GHSA-rrff-chj9-w4c7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-rrff-chj9-w4c7/GHSA-rrff-chj9-w4c7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rrff-chj9-w4c7

Aliases

CVE-2025-24853

Published

2025-07-31T09:32:49Z

Modified

2025-07-31T15:12:21.268347Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

Apache JSPWiki Cross-Site Scripting (XSS) Vulnerability via Header Link Rendering

Details

A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

Further research by the JSPWiki team showed that the markdown parser allowed this kind of attack too.

Apache JSPWiki users should upgrade to 2.12.3 or later.

Database specific

{
    "github_reviewed": true,
    "nvd_published_at": "2025-07-31T09:15:26Z",
    "github_reviewed_at": "2025-07-31T14:11:06Z",
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-79"
    ]
}

References

Affected packages

Maven / org.apache.jspwiki:jspwiki-main

Package

Name: org.apache.jspwiki:jspwiki-main; View open source insights on deps.dev
Purl: pkg:maven/org.apache.jspwiki/jspwiki-main

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.12.3

Affected versions

2.*

2.11.0.M1

2.11.0.M2

2.11.0.M3

2.11.0.M4

2.11.0.M5

2.11.0.M6

2.11.0.M7

2.11.0.M8

2.11.0

2.11.1

2.11.2

2.11.3

2.12.0

2.12.1

2.12.2

Maven / org.apache.jspwiki:jspwiki-markdown