CVE-2019-10089: Cross-site scripting in Apache JSPWiki

org.apache.jspwiki:jspwiki-war Updated 02 Oct 2025

Summary

11/10/2019

Disclosed on

CVE-2019-10089

CVE

Yes i

Fix available

Moderate

Severity

6.1

CVSS Score

CVE-2019-10089: Cross-site scripting in Apache JSPWiki. Affects org.apache.jspwiki:jspwiki-war versions >= 2.9.0, < 2.11.0.M5. Fixed in 2.11.0.M5. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Apache JSPWiki is an open-source Java-based wiki engine that allows users to create and manage content collaboratively. It provides features like version control, access control, and a WYSIWYG editor. The vulnerability identified as CVE-2019-10089 affects Apache JSPWiki versions up to 2.11.0.M4. This vulnerability allows an attacker to execute malicious JavaScript code in a victim's browser through a carefully crafted plugin link invocation. The vulnerability is related to the WYSIWYG editor and can potentially lead to the disclosure of sensitive information about the victim.

Vulnerability Detail

The CVE-2019-10089 vulnerability in Apache JSPWiki arises from a cross-site scripting (XSS) flaw. By exploiting this vulnerability, an attacker can inject and execute arbitrary JavaScript code in the victim's browser. This can result in various malicious activities, such as stealing sensitive information, session hijacking, or performing actions on behalf of the victim. The vulnerability is triggered by a specific plugin link invocation and affects versions of Apache JSPWiki up to 2.11.0.M4. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-79.

How To Fix

Minimum fixed version

2.11.0.M5

This is the first release that contains the fix.

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Conclusion

The CVE-2019-10089 vulnerability in Apache JSPWiki exposes users to the risk of cross-site scripting attacks. It is crucial to promptly upgrade to version 2.11.0.M5 or later to mitigate this vulnerability. For further assistance and support in addressing this vulnerability, please contact DevNack.com.

See every vulnerability recorded for org.apache.jspwiki:jspwiki-war →