CVE-2024-27136: Cross-Site Scripting in Apache JSPWiki
Summary
CVE-2024-27136: Cross site scripting in Apache JSPWiki. Affects org.apache.jspwiki:jspwiki-main versions < 2.12.2. Fixed in 2.12.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache JSPWiki is an open-source Java-based wiki engine that allows users to create and manage content collaboratively. It is commonly used for creating and maintaining knowledge bases, documentation, and websites. The vulnerability identified as CVE-2024-27136 affects Apache JSPWiki versions 2.12.1 and prior. This vulnerability allows an attacker to execute malicious JavaScript code in the victim's browser, potentially leading to the disclosure of sensitive information. It is important for Apache JSPWiki users to upgrade to version 2.12.2 or later to mitigate this vulnerability.
Vulnerability Detail
The CVE-2024-27136 vulnerability in Apache JSPWiki arises from a cross-site scripting (XSS) issue in the Upload page. By exploiting this vulnerability, an attacker can inject and execute arbitrary JavaScript code in the victim's browser. This can lead to various malicious activities, such as stealing sensitive information, session hijacking, or performing actions on behalf of the victim. The impact of this vulnerability is considered moderate, with a CVSS score of 6.3.
How To Fix
Minimum fixed version
2.12.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the affected Upload page in Apache JSPWiki to mitigate the risk of exploitation. This can be achieved by modifying the configuration or access permissions to prevent unauthorized access to the Upload page. However, it is strongly recommended to apply the official fix by upgrading to a patched version as soon as possible.
Conclusion
The CVE-2024-27136 vulnerability in Apache JSPWiki exposes users to the risk of cross-site scripting (XSS) attacks. Upgrading to version 2.12.2 or later is crucial to address this vulnerability and prevent potential unauthorized access, data theft, or other malicious activities. Users can also utilize Vulert, a tool that provides real-time monitoring and alerts for open-source vulnerabilities, to check if their Apache JSPWiki installation is affected.
See every vulnerability recorded for org.apache.jspwiki:jspwiki-main →
FAQ
Apache JSPWiki is an open-source Java-based wiki engine used for collaborative content creation and management.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
The impact of CVE-2024-27136 is considered moderate, with the potential for attackers to execute arbitrary JavaScript code in the victim's browser and potentially disclose sensitive information.
To fix the CVE-2024-27136 vulnerability, users should upgrade their Apache JSPWiki installations to version 2.12.2 or later.
As a temporary workaround, users can disable the affected Upload page in Apache JSPWiki to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.jspwiki:jspwiki-main.
