CVE-2021-40369: Apache JSPWiki Cross-site Scripting Vulnerability
Summary
CVE-2021-40369: Apache JSPWiki Cross-site Scripting due to carefully crafted plugin link invocation. Affects org.apache.jspwiki:jspwiki-main versions < 2.11.0. Fixed in 2.11.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache JSPWiki is an open-source Java-based wiki engine that allows users to create and manage content collaboratively. It provides a platform for creating and editing wiki pages, supporting various plugins for extended functionality. The JSPWiki Denounce plugin, when invoked with a carefully crafted link, can trigger a cross-site scripting (XSS) vulnerability. This vulnerability can be exploited by an attacker to execute malicious JavaScript code in the victim's browser, potentially leading to the disclosure of sensitive information.
Vulnerability Detail
The Apache JSPWiki vulnerability (CVE-2021-40369) arises from a flaw in the Denounce plugin's handling of plugin link invocations. By constructing a specially crafted link, an attacker can inject arbitrary JavaScript code into the victim's browser. This code can then be used to perform various malicious actions, such as stealing sensitive information or performing unauthorized actions on behalf of the victim. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
2.11.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patch by upgrading to Apache JSPWiki version 2.11.0 or later.
Conclusion
The Apache JSPWiki Cross-site Scripting vulnerability (CVE-2021-40369) in the Denounce plugin can be mitigated by upgrading to version 2.11.0 or later. It is crucial for users to promptly apply the patch to protect their systems from potential exploitation. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.jspwiki:jspwiki-main →
FAQ
Apache JSPWiki is an open-source Java-based wiki engine that allows users to create and manage content collaboratively.
The Denounce plugin is a plugin for Apache JSPWiki that provides functionality for denouncing or reporting inappropriate content.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
The vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim's browser, potentially leading to the disclosure of sensitive information or unauthorized actions on behalf of the victim.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.jspwiki:jspwiki-main.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
