CVE-2019-12407

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources

Severity

6.1MEDIUM

EPSS

4.4%

top 10.97%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Apache Jspwiki

Timeline

PublishedSep 23

Latest updateMay 24

Description

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the remember parameter on some of the JSPs, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages4 packages

▶Mavenorg.apache.jspwiki:jspwiki-war< 2.11.0.M5

▶Mavenorg.apache.jspwiki:jspwiki-main< 2.11.0.M5

▶NVDapache/jspwiki2.10.5+1

▶CVEListV5apache_jspwikiApache JSPWiki up to 2.11.0.M4

🔴Vulnerability Details

OSV

Cross-site Scripting in Apache JSPWiki↗2022-05-24

▶

GHSA

Cross-site Scripting in Apache JSPWiki↗2022-05-24

▶

CVEList

CVE-2019-12407: On Apache JSPWiki, up to version 2↗2019-09-23

▶