CVE-2019-10077: Cross-site Scripting in JSPWiki
Summary
CVE-2019-10077: Cross-site Scripting in JSPWiki. Affects org.apache.jspwiki:jspwiki-war versions >= 2.9.0, < 2.11.0.M4. Fixed in 2.11.0.M4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache JSPWiki is an open-source wiki engine built in Java. It provides a platform for collaborative content creation and management. JSPWiki is widely used for creating and maintaining wikis, blogs, and other web-based applications. However, versions 2.9.0 to 2.11.0.M3 of JSPWiki are vulnerable to a cross-site scripting (XSS) attack. This vulnerability can be exploited through a carefully crafted InterWiki link, potentially leading to session hijacking.
Vulnerability Detail
The XSS vulnerability in JSPWiki allows an attacker to inject malicious scripts into web pages viewed by users. By crafting a specially designed InterWiki link, an attacker can execute arbitrary code in the context of the victim's browser. This can lead to various security issues, including session hijacking, unauthorized access to sensitive information, and potential control over user accounts. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
2.11.0.M4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the rendering of InterWiki links in JSPWiki. This can be achieved by modifying the configuration settings to disallow the processing of InterWiki links. However, this workaround may impact the functionality and usability of the application, so it is advisable to apply the official fix by upgrading to the latest version.
Conclusion
The XSS vulnerability in JSPWiki can have serious security implications, including session hijacking and unauthorized access to sensitive information. It is crucial to promptly apply the recommended fix by upgrading to version 2.11.0.M4 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.jspwiki:jspwiki-war →
FAQ
The vulnerability allows an attacker to execute arbitrary code in the victim's browser, potentially leading to session hijacking and unauthorized access to sensitive information.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this XSS vulnerability in JSPWiki.
Yes, the Apache JSPWiki project has released version 2.11.0.M4, which addresses this XSS vulnerability. It is recommended to upgrade to this version or any subsequent releases to mitigate the risk.
Yes, you can disable the rendering of InterWiki links in JSPWiki as a temporary workaround. However, this may impact the functionality of your application, so it is advisable to apply the official fix by upgrading to the latest version.
The CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.jspwiki:jspwiki-war.
