CVE-2019-10087: Cross-site scripting in Apache JSPWiki
Summary
CVE-2019-10087: Cross-site scripting in Apache JSPWiki. Affects org.apache.jspwiki:jspwiki-war versions >= 2.9.0, < 2.11.0.M5. Fixed in 2.11.0.M5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache JSPWiki is an open-source wiki engine built in Java. It allows users to create and edit wiki pages, making it a popular choice for collaborative content creation. However, versions up to 2.11.0.M4 of Apache JSPWiki are vulnerable to a cross-site scripting (XSS) attack. This vulnerability can be exploited through a carefully crafted plugin link invocation, specifically related to the Page Revision History. An attacker could execute malicious JavaScript code in the victim's browser, potentially gaining access to sensitive information.
Vulnerability Detail
The XSS vulnerability in Apache JSPWiki arises from a flaw in the handling of plugin link invocations. By manipulating the link parameters, an attacker can inject and execute arbitrary JavaScript code in the victim's browser. This can lead to various consequences, such as stealing session cookies, redirecting users to malicious websites, or performing actions on behalf of the victim. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Latest published version: 3.0.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.11.0.M5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the affected functionality related to the Page Revision History. This can be achieved by modifying the configuration or removing the plugin responsible for the vulnerability. However, this workaround should only be considered as a temporary measure until the upgrade can be performed.
Conclusion
The XSS vulnerability in Apache JSPWiki poses a moderate risk to systems running affected versions. To mitigate this vulnerability, it is recommended to upgrade to version 2.11.0.M5 or later. If immediate upgrading is not possible, disabling the functionality related to the Page Revision History can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.jspwiki:jspwiki-war →
FAQ
Apache JSPWiki is an open-source wiki engine written in Java. It allows users to collaboratively create and edit wiki pages.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as stealing sensitive information or performing actions on behalf of the victim.
The XSS vulnerability in Apache JSPWiki is triggered by a carefully crafted plugin link invocation. By manipulating the link parameters, an attacker can inject and execute arbitrary JavaScript code in the victim's browser.
The XSS vulnerability in Apache JSPWiki can allow an attacker to steal session cookies, redirect users to malicious websites, or perform actions on behalf of the victim. This can lead to unauthorized access to sensitive information or the compromise of user accounts.
To protect your Apache JSPWiki installation, it is crucial to keep the software up to date. Ensure that you are running version 2.11.0.M5 or later, which includes the necessary patches to mitigate the XSS vulnerability. Regularly check for updates and apply them promptly.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.jspwiki:jspwiki-war.
