CVE-2016-0712

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources

Severity

6.1MEDIUM

EPSS

2.6%

top 14.51%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Apache Jetspeed

Timeline

PublishedApr 11

Latest updateMay 17

Description

Cross-site scripting (XSS) vulnerability in Apache Jetspeed before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to portal.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶Mavenorg.apache.portals.jetspeed-2:jetspeed< 2.3.1

▶NVDapache/jetspeed2.3.0

🔴Vulnerability Details

GHSA

Cross-site Scripting in Apache Jetspeed↗2022-05-17

▶

OSV

Cross-site Scripting in Apache Jetspeed↗2022-05-17

▶

CVEList

CVE-2016-0712: Cross-site scripting (XSS) vulnerability in Apache Jetspeed before 2↗2016-04-11

▶