CVE-2019-12407: Cross-site Scripting in Apache JSPWiki
Summary
CVE-2019-12407: Cross-site Scripting in Apache JSPWiki. Affects org.apache.jspwiki:jspwiki-war versions < 2.11.0.M5. Fixed in 2.11.0.M5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache JSPWiki is an open-source Java-based wiki engine that allows users to create and manage content collaboratively. It provides a platform for creating and editing web pages, making it a popular choice for knowledge management systems and documentation websites. However, versions up to 2.11.0.M4 of Apache JSPWiki are vulnerable to a cross-site scripting (XSS) attack.
Vulnerability Detail
The XSS vulnerability in Apache JSPWiki arises from a flaw in the handling of plugin link invocations. By carefully crafting a plugin link, an attacker can trigger the vulnerability by exploiting the 'remember' parameter on certain JSPs. This allows the attacker to execute arbitrary JavaScript code in the victim's browser, potentially leading to the disclosure of sensitive information or the manipulation of user sessions.
How To Fix
Minimum fixed version
2.11.0.M5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the affected JSPs or remove the 'remember' parameter from the plugin link invocations. However, this workaround may impact the functionality of certain features or plugins.
Conclusion
In conclusion, Apache JSPWiki versions up to 2.11.0.M4 are vulnerable to a cross-site scripting (XSS) attack. It is crucial to upgrade to version 2.11.0.M5 or later to mitigate this vulnerability. If immediate upgrade is not possible, consider applying the provided workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.jspwiki:jspwiki-war →
FAQ
Apache JSPWiki is an open-source Java-based wiki engine that allows users to create and manage content collaboratively.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
This vulnerability allows an attacker to execute arbitrary JavaScript code in the victim's browser, potentially leading to the disclosure of sensitive information or the manipulation of user sessions.
To fix this vulnerability, it is recommended to upgrade to Apache JSPWiki version 2.11.0.M5 or later.
A temporary workaround is to disable the affected JSPs or remove the 'remember' parameter from the plugin link invocations.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.jspwiki:jspwiki-war.
