Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
58 vulnerabilities found for jspwiki by apache
CVE-2026-48910 (GCVE-0-2026-48910)
Vulnerability from nvd – Published: 2026-07-30 15:56 – Updated: 2026-07-30 16:37
VLAI
EPSS
VEX
Title
Apache JSPWiki: Markdown parser allows XSS injection in Markdown error processing
Summary
A carefully crafted editing request could trigger an XSS vulnerability
on Apache JSPWiki when parsing errors on the markdown renderer, which
could allow the attacker to execute javascript in the victim's browser
and get some sensitive information about the victim.
This issue affects Apache JSPWiki: through 2.12.3.
Users are recommended to upgrade to version 2.12.4, which fixes the issue.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/yvbdjnocw5qq3xkbj… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/0… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
0 , ≤ 2.12.3
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-48910",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-30T16:36:48.479198Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T16:36:52.080Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-07-30T16:37:15.693Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/30/18"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.12.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Justin Ng from Cyver Security Agency of Singapore / Inland Reveue Authority of Singapore"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA carefully crafted editing request could trigger an XSS vulnerability \non Apache JSPWiki when parsing errors on the markdown renderer, which \ncould allow the attacker to execute javascript in the victim\u0027s browser \nand get some sensitive information about the victim.\n\u003c/p\u003e\u003cp\u003eThis issue affects Apache JSPWiki: through 2.12.3.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 2.12.4, which fixes the issue.\u003c/p\u003e"
}
],
"value": "A carefully crafted editing request could trigger an XSS vulnerability \non Apache JSPWiki when parsing errors on the markdown renderer, which \ncould allow the attacker to execute javascript in the victim\u0027s browser \nand get some sensitive information about the victim.\n\n\nThis issue affects Apache JSPWiki: through 2.12.3.\n\nUsers are recommended to upgrade to version 2.12.4, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T15:56:33.613Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/yvbdjnocw5qq3xkbjs9h77ghlg0bsw2c"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache JSPWiki: Markdown parser allows XSS injection in Markdown error processing",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-48910",
"datePublished": "2026-07-30T15:56:33.613Z",
"dateReserved": "2026-05-26T10:41:07.254Z",
"dateUpdated": "2026-07-30T16:37:15.693Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28814 (GCVE-0-2026-28814)
Vulnerability from nvd – Published: 2026-07-30 15:55 – Updated: 2026-07-31 17:55
VLAI
EPSS
VEX
Title
Apache JSPWiki: Pre-Authentication Arbitrary Wiki Markup Rendering
Summary
Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables.
Users are recommended to upgrade to version 2.12.4 or 3.0.0, which fixes this issue.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Arbitrary Wiki Markup rendering due to lack of authentication
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/8vv0311bvrrqxsyn9… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/0… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
0 , < 2.12.4
(semver)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-30T16:36:36.963Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/30/17"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-28814",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T17:55:52.115268Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T17:55:59.734Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "2.12.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Miguel Regala (Fisher) - Hadrian.io"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables.\u003cbr\u003eUsers are recommended to upgrade to version 2.12.4 or 3.0.0, which fixes this issue."
}
],
"value": "Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables.\nUsers are recommended to upgrade to version 2.12.4 or 3.0.0, which fixes this issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "critical"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Arbitrary Wiki Markup rendering due to lack of authentication",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T15:55:28.034Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/8vv0311bvrrqxsyn913pcwf7pctyk52w"
}
],
"source": {
"defect": [
"JSPWIKI-1270"
],
"discovery": "UNKNOWN"
},
"title": "Apache JSPWiki: Pre-Authentication Arbitrary Wiki Markup Rendering",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-28814",
"datePublished": "2026-07-30T15:55:28.034Z",
"dateReserved": "2026-03-03T15:02:10.764Z",
"dateUpdated": "2026-07-31T17:55:59.734Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28813 (GCVE-0-2026-28813)
Vulnerability from nvd – Published: 2026-07-30 15:54 – Updated: 2026-07-31 11:34
VLAI
EPSS
VEX
Title
Apache JSPWiki: JSPWiki vulnerable to JSON hijacking
Summary
Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities.
Users are recommended to upgrade to version 2.12.4, which fixes this issue.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/56440mymwkxt1hf3j… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/0… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
0 , < 2.12.4
(semver)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-30T16:36:34.389Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/30/16"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-28813",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T11:34:29.515111Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T11:34:33.218Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "2.12.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Janne Jalkannen from Apache JSPWiki"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities.\u003cbr\u003eUsers are recommended to upgrade to version 2.12.4, which fixes this issue."
}
],
"value": "Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities.\nUsers are recommended to upgrade to version 2.12.4, which fixes this issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T15:54:19.667Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/56440mymwkxt1hf3j8hjpo41yco7gotv"
}
],
"source": {
"defect": [
"JSPWIKI-175",
"JSPWIKI-1229",
"JSPWIKI-1262"
],
"discovery": "UNKNOWN"
},
"title": "Apache JSPWiki: JSPWiki vulnerable to JSON hijacking",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-28813",
"datePublished": "2026-07-30T15:54:19.667Z",
"dateReserved": "2026-03-03T15:01:42.672Z",
"dateUpdated": "2026-07-31T11:34:33.218Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28812 (GCVE-0-2026-28812)
Vulnerability from nvd – Published: 2026-07-30 15:52 – Updated: 2026-07-31 15:28
VLAI
EPSS
VEX
Title
Apache JSPWiki: UserManager does not sanity-check user database at startup
Summary
UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges.
Users are recommended to upgrade to version 2.12.4 or newer which fixes this issue.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- Use of impersonation
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/n3m666d6t6871dldv… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/0… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
0 , < 2.12.4
(semver)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-30T16:36:31.861Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/30/15"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-28812",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T15:28:05.878355Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T15:28:08.984Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "2.12.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Florian Holeczek from Apache JSPWiki"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges.\u003cbr\u003eUsers are recommended to upgrade to version 2.12.4 or newer which fixes this issue."
}
],
"value": "UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges.\nUsers are recommended to upgrade to version 2.12.4 or newer which fixes this issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Use of impersonation",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T15:52:34.172Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/n3m666d6t6871dldvz3ct49ooqkbgw2p"
}
],
"source": {
"defect": [
"JSPWIKI-130"
],
"discovery": "UNKNOWN"
},
"title": "Apache JSPWiki: UserManager does not sanity-check user database at startup",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-28812",
"datePublished": "2026-07-30T15:52:34.172Z",
"dateReserved": "2026-03-03T15:01:12.543Z",
"dateUpdated": "2026-07-31T15:28:08.984Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28811 (GCVE-0-2026-28811)
Vulnerability from nvd – Published: 2026-07-30 15:51 – Updated: 2026-07-31 17:54
VLAI
EPSS
VEX
Title
Apache JSPWiki: Error Handling - Reveals Error Details
Summary
Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3.
Users are recommended to upgrade to version 2.12.4, which fixes this issue.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-1295 - Debug Messages Revealing Unnecessary Information
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
0 , < up to 3.0.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-30T16:36:29.298Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/30/14"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-28811",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T17:53:53.456751Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T17:54:14.250Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "up to 3.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Cristian Borlovan from Ounce Labs"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3.\u003cbr\u003eUsers are recommended to upgrade to version 2.12.4, which fixes this issue."
}
],
"value": "Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3.\nUsers are recommended to upgrade to version 2.12.4, which fixes this issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "low"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1295",
"description": "CWE-1295 Debug Messages Revealing Unnecessary Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T15:51:27.131Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/2dm414zzjo3pvhjz6mvqy3b5yhvnkcg5"
},
{
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2026-28811"
}
],
"source": {
"defect": [
"JSPWIKI-75"
],
"discovery": "UNKNOWN"
},
"title": "Apache JSPWiki: Error Handling - Reveals Error Details",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-28811",
"datePublished": "2026-07-30T15:51:27.131Z",
"dateReserved": "2026-03-03T15:00:35.684Z",
"dateUpdated": "2026-07-31T17:54:14.250Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-24854 (GCVE-0-2025-24854)
Vulnerability from nvd – Published: 2025-07-31 08:43 – Updated: 2025-11-04 21:09
VLAI
EPSS
VEX
Title
Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Image plugin
Summary
A carefully crafted request using the Image plugin could trigger an XSS
vulnerability on Apache JSPWiki, which could allow the attacker to
execute javascript in the victim's browser and get some sensitive
information about the victim.
Apache JSPWiki users should upgrade to 2.12.3 or later.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
0 , ≤ 2.12.2
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-24854",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-31T13:38:50.896375Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-31T17:55:04.477Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T21:09:44.925Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2025/07/30/3"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.12.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The issue was separately discovered by both XBOW (https://github.com/xbow-security, https://xbow.com) and Hamed Kohi \u003c0x.hamy.1ATgmailDOTcom\u003e"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eA carefully crafted request using the Image plugin could trigger an XSS \nvulnerability on Apache JSPWiki, which could allow the attacker to \nexecute javascript in the victim\u0027s browser and get some sensitive \ninformation about the victim.\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eApache JSPWiki users should upgrade to 2.12.3 or later.\u003cbr\u003e\u003c/div\u003e"
}
],
"value": "A carefully crafted request using the Image plugin could trigger an XSS \nvulnerability on Apache JSPWiki, which could allow the attacker to \nexecute javascript in the victim\u0027s browser and get some sensitive \ninformation about the victim.\n\n\n\n\n\nApache JSPWiki users should upgrade to 2.12.3 or later."
}
],
"metrics": [
{
"other": {
"content": {
"text": "Medium"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-31T08:43:18.886Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2025-24854"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Image plugin",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2025-24854",
"datePublished": "2025-07-31T08:43:18.886Z",
"dateReserved": "2025-01-25T20:04:53.948Z",
"dateUpdated": "2025-11-04T21:09:44.925Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-24853 (GCVE-0-2025-24853)
Vulnerability from nvd – Published: 2025-07-31 08:42 – Updated: 2025-11-04 21:09
VLAI
EPSS
VEX
Title
Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Header Link processing
Summary
A carefully crafted request when creating a header link using the
wiki markup syntax, which could allow the attacker to execute javascript
in the victim's browser and get some sensitive information about the
victim.
Further research by the JSPWiki team showed that the markdown parser allowed this kind of attack too.
Apache JSPWiki users should upgrade to 2.12.3 or later.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
0 , ≤ 2.12.2
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-24853",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-31T13:39:02.510980Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-31T17:55:11.018Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T21:09:43.620Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2025/07/30/2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.12.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The issue was discovered by XBOW (https://github.com/xbow-security, https://xbow.com)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA carefully crafted request when creating a header link using the \nwiki markup syntax, which could allow the attacker to execute javascript\n in the victim\u0027s browser and get some sensitive information about the \nvictim.\n\u003c/p\u003e\n\u003cp\u003eFurther research by the JSPWiki team showed that the markdown parser allowed this kind of attack too.\u003c/p\u003e\u003cp\u003eApache JSPWiki users should upgrade to 2.12.3 or later.\u003cbr\u003e\u003c/p\u003e\u003cbr\u003e"
}
],
"value": "A carefully crafted request when creating a header link using the \nwiki markup syntax, which could allow the attacker to execute javascript\n in the victim\u0027s browser and get some sensitive information about the \nvictim.\n\n\n\nFurther research by the JSPWiki team showed that the markdown parser allowed this kind of attack too.\n\nApache JSPWiki users should upgrade to 2.12.3 or later."
}
],
"metrics": [
{
"other": {
"content": {
"text": "Medium"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-31T08:42:06.453Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2025-24853"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Header Link processing",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2025-24853",
"datePublished": "2025-07-31T08:42:06.453Z",
"dateReserved": "2025-01-25T20:03:15.418Z",
"dateUpdated": "2025-11-04T21:09:43.620Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-27136 (GCVE-0-2024-27136)
Vulnerability from nvd – Published: 2024-06-24 07:44 – Updated: 2025-03-20 18:03
VLAI
EPSS
VEX
Title
Apache JSPWiki: Cross-site scripting vulnerability on upload page
Summary
XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.2 or later.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/gfms8gbncqqkj52p8… | vendor-advisory |
| https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2024/06/23/3 |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
0 , ≤ 2.12.1
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-27136",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-24T13:27:24.688821Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-20T18:03:19.410Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-09-13T16:03:09.936Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.apache.org/thread/gfms8gbncqqkj52p861b8fnsypwsl1d5"
},
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2024-27136"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/06/23/3"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.12.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by sonnh from Vietnam National Cyber security technology corporation"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim\u0027s browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.2 or later. "
}
],
"value": "XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim\u0027s browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.2 or later. "
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-24T07:44:30.732Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/gfms8gbncqqkj52p861b8fnsypwsl1d5"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2024-27136"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache JSPWiki: Cross-site scripting vulnerability on upload page",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2024-27136",
"datePublished": "2024-06-24T07:44:30.732Z",
"dateReserved": "2024-02-20T12:13:15.203Z",
"dateUpdated": "2025-03-20T18:03:19.410Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-46907 (GCVE-0-2022-46907)
Vulnerability from nvd – Published: 2023-05-25 06:58 – Updated: 2025-02-13 16:33
VLAI
EPSS
VEX
Title
Apache JSPWiki: XSS Injection points in several plugins
Summary
A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.0 or later.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
0 , < Apache JSPWiki up to 2.12.0
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T14:47:27.792Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.apache.org/thread/1m0mkq2nttx8tn94m11mytn4f0tv1504"
},
{
"tags": [
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2023/05/25/1"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-46907",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-09T19:56:09.990171Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-09T19:56:24.015Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "Apache JSPWiki up to 2.12.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Eugene Lim and Sng Jay Kai from Government Technology Agency of Singapore"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim\u0027s browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.0 or later.\u003cbr\u003e"
}
],
"value": "A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim\u0027s browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.0 or later."
}
],
"metrics": [
{
"other": {
"content": {
"text": "Medium"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-25T07:00:09.411Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/1m0mkq2nttx8tn94m11mytn4f0tv1504"
},
{
"url": "http://www.openwall.com/lists/oss-security/2023/05/25/1"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Apache JSPWiki: XSS Injection points in several plugins",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2022-46907",
"datePublished": "2023-05-25T06:58:18.912Z",
"dateReserved": "2022-12-10T15:13:04.776Z",
"dateUpdated": "2025-02-13T16:33:58.435Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-34158 (GCVE-0-2022-34158)
Vulnerability from nvd – Published: 2022-08-04 06:16 – Updated: 2024-08-03 08:16
VLAI
EPSS
VEX
Title
User Group Privilege Escalation
Summary
A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege escalation of the attacker's account. Further examination of this issue established that it could also be used to modify the email associated with the attacked account, and then a reset password request from the login page.
Severity
No CVSS data available.
CWE
- CSRF group privilege escalation
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
unspecified , ≤ Apache JSPWiki up to 2.11.2
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T08:16:17.225Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-34158"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "Apache JSPWiki up to 2.11.2",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was discovered by Huiseong Seo (t0rchwo0d), \u003cawdr1624AT gmail DOT com\u003e"
}
],
"descriptions": [
{
"lang": "en",
"value": "A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege escalation of the attacker\u0027s account. Further examination of this issue established that it could also be used to modify the email associated with the attacked account, and then a reset password request from the login page."
}
],
"metrics": [
{
"other": {
"content": {
"other": "critical"
},
"type": "unknown"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CSRF group privilege escalation",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-08-04T06:16:11.000Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-34158"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "User Group Privilege Escalation",
"workarounds": [
{
"lang": "en",
"value": "Apache JSPWiki users should upgrade to 2.11.3 or later."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"ID": "CVE-2022-34158",
"STATE": "PUBLIC",
"TITLE": "User Group Privilege Escalation"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Apache JSPWiki",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "Apache JSPWiki up to 2.11.2"
}
]
}
}
]
},
"vendor_name": "Apache Software Foundation"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was discovered by Huiseong Seo (t0rchwo0d), \u003cawdr1624AT gmail DOT com\u003e"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege escalation of the attacker\u0027s account. Further examination of this issue established that it could also be used to modify the email associated with the attacked account, and then a reset password request from the login page."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": [
{
"other": "critical"
}
],
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CSRF group privilege escalation"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-34158",
"refsource": "MISC",
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-34158"
}
]
},
"source": {
"discovery": "UNKNOWN"
},
"work_around": [
{
"lang": "en",
"value": "Apache JSPWiki users should upgrade to 2.11.3 or later."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2022-34158",
"datePublished": "2022-08-04T06:16:11.000Z",
"dateReserved": "2022-06-20T00:00:00.000Z",
"dateUpdated": "2024-08-03T08:16:17.225Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-28732 (GCVE-0-2022-28732)
Vulnerability from nvd – Published: 2022-08-04 06:15 – Updated: 2024-08-03 06:03
VLAI
EPSS
VEX
Title
Apache JSPWiki Cross-site scripting vulnerability on WeblogPlugin
Summary
A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.3 or later.
Severity
No CVSS data available.
CWE
- XSS
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
Apache JSPWiki , ≤ Apache JSPWiki up to 2.11.2
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T06:03:52.589Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "Apache JSPWiki up to 2.11.2",
"status": "affected",
"version": "Apache JSPWiki",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was discovered by Wang Ran, from JDArmy, @jd.com"
}
],
"descriptions": [
{
"lang": "en",
"value": "A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim\u0027s browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.3 or later."
}
],
"metrics": [
{
"other": {
"content": {
"other": "moderate"
},
"type": "unknown"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "XSS",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-08-04T06:15:57.000Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache JSPWiki Cross-site scripting vulnerability on WeblogPlugin",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"ID": "CVE-2022-28732",
"STATE": "PUBLIC",
"TITLE": "Apache JSPWiki Cross-site scripting vulnerability on WeblogPlugin"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Apache JSPWiki",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "Apache JSPWiki",
"version_value": "Apache JSPWiki up to 2.11.2"
}
]
}
}
]
},
"vendor_name": "Apache Software Foundation"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was discovered by Wang Ran, from JDArmy, @jd.com"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim\u0027s browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.3 or later."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": [
{
"other": "moderate"
}
],
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "XSS"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732",
"refsource": "MISC",
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2022-28732",
"datePublished": "2022-08-04T06:15:57.000Z",
"dateReserved": "2022-04-05T00:00:00.000Z",
"dateUpdated": "2024-08-03T06:03:52.589Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-28731 (GCVE-0-2022-28731)
Vulnerability from nvd – Published: 2022-08-04 06:15 – Updated: 2024-08-03 06:03
VLAI
EPSS
VEX
Title
Apache JSPWiki CSRF in UserPreferences.jsp
Summary
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
Severity
No CVSS data available.
CWE
- CSRF Account Takeover
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
Apache JSPWiki , ≤ Apache JSPWiki up to 2.11.2
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T06:03:52.648Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "Apache JSPWiki up to 2.11.2",
"status": "affected",
"version": "Apache JSPWiki",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was discovered by Fabrice Perez, \u003cfabioperez AT gmail DOT com\u003e"
}
],
"descriptions": [
{
"lang": "en",
"value": "A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page."
}
],
"metrics": [
{
"other": {
"content": {
"other": "critical"
},
"type": "unknown"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CSRF Account Takeover",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-08-04T06:15:43.000Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache JSPWiki CSRF in UserPreferences.jsp",
"workarounds": [
{
"lang": "en",
"value": "Apache JSPWiki users should upgrade to 2.11.3 or later. Installations \u003e= 2.7.0 can also enable user management workflows\u0027 manual approval to mitigate the issue."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"ID": "CVE-2022-28731",
"STATE": "PUBLIC",
"TITLE": "Apache JSPWiki CSRF in UserPreferences.jsp"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Apache JSPWiki",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "Apache JSPWiki",
"version_value": "Apache JSPWiki up to 2.11.2"
}
]
}
}
]
},
"vendor_name": "Apache Software Foundation"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was discovered by Fabrice Perez, \u003cfabioperez AT gmail DOT com\u003e"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": [
{
"other": "critical"
}
],
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CSRF Account Takeover"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732",
"refsource": "MISC",
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
}
]
},
"source": {
"discovery": "UNKNOWN"
},
"work_around": [
{
"lang": "en",
"value": "Apache JSPWiki users should upgrade to 2.11.3 or later. Installations \u003e= 2.7.0 can also enable user management workflows\u0027 manual approval to mitigate the issue."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2022-28731",
"datePublished": "2022-08-04T06:15:43.000Z",
"dateReserved": "2022-04-05T00:00:00.000Z",
"dateUpdated": "2024-08-03T06:03:52.648Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-28730 (GCVE-0-2022-28730)
Vulnerability from nvd – Published: 2022-08-04 06:15 – Updated: 2024-08-03 06:03
VLAI
EPSS
VEX
Title
Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp
Summary
A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This vulnerability leverages CVE-2021-40369, where the Denounce plugin dangerously renders user-supplied URLs. Upon re-testing CVE-2021-40369, it appears that the patch was incomplete as it was still possible to insert malicious input via the Denounce plugin. Apache JSPWiki users should upgrade to 2.11.3 or later.
Severity
No CVSS data available.
CWE
- XSS
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
Apache JSPWiki , ≤ Apache JSPWiki up to 2.11.2
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T06:03:52.583Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "Apache JSPWiki up to 2.11.2",
"status": "affected",
"version": "Apache JSPWiki",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was discovered by Poh Jia Hao, from Star Labs \u003cinfo AT starlabs DOT sg\u003e"
}
],
"descriptions": [
{
"lang": "en",
"value": "A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim\u0027s browser and get some sensitive information about the victim. This vulnerability leverages CVE-2021-40369, where the Denounce plugin dangerously renders user-supplied URLs. Upon re-testing CVE-2021-40369, it appears that the patch was incomplete as it was still possible to insert malicious input via the Denounce plugin. Apache JSPWiki users should upgrade to 2.11.3 or later."
}
],
"metrics": [
{
"other": {
"content": {
"other": "moderate"
},
"type": "unknown"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "XSS",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-08-04T06:15:29.000Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"ID": "CVE-2022-28730",
"STATE": "PUBLIC",
"TITLE": "Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Apache JSPWiki",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "Apache JSPWiki",
"version_value": "Apache JSPWiki up to 2.11.2"
}
]
}
}
]
},
"vendor_name": "Apache Software Foundation"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was discovered by Poh Jia Hao, from Star Labs \u003cinfo AT starlabs DOT sg\u003e"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim\u0027s browser and get some sensitive information about the victim. This vulnerability leverages CVE-2021-40369, where the Denounce plugin dangerously renders user-supplied URLs. Upon re-testing CVE-2021-40369, it appears that the patch was incomplete as it was still possible to insert malicious input via the Denounce plugin. Apache JSPWiki users should upgrade to 2.11.3 or later."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": [
{
"other": "moderate"
}
],
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "XSS"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732",
"refsource": "MISC",
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2022-28730",
"datePublished": "2022-08-04T06:15:29.000Z",
"dateReserved": "2022-04-05T00:00:00.000Z",
"dateUpdated": "2024-08-03T06:03:52.583Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-27166 (GCVE-0-2022-27166)
Vulnerability from nvd – Published: 2022-08-04 06:15 – Updated: 2024-08-03 05:18
VLAI
EPSS
VEX
Title
XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2
Summary
A carefully crafted request on XHRHtml2Markup.jsp could trigger an XSS vulnerability on Apache JSPWiki up to and including 2.11.2, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Severity
No CVSS data available.
CWE
- Cross-site scripting vulnerability on XHRHtml2Markup.jsp
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
Apache JSPWiki , ≤ Apache JSPWiki up to 2.11.2
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T05:18:39.251Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "Apache JSPWiki up to 2.11.2",
"status": "affected",
"version": "Apache JSPWiki",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Issue was discovered by Salt, \u003csaltnekoko AT gmail DOT com\u003e"
}
],
"descriptions": [
{
"lang": "en",
"value": "A carefully crafted request on XHRHtml2Markup.jsp could trigger an XSS vulnerability on Apache JSPWiki up to and including 2.11.2, which could allow the attacker to execute javascript in the victim\u0027s browser and get some sensitive information about the victim."
}
],
"metrics": [
{
"other": {
"content": {
"other": "moderate"
},
"type": "unknown"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-site scripting vulnerability on XHRHtml2Markup.jsp",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-08-04T06:15:17.000Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"ID": "CVE-2022-27166",
"STATE": "PUBLIC",
"TITLE": "XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Apache JSPWiki",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "Apache JSPWiki",
"version_value": "Apache JSPWiki up to 2.11.2"
}
]
}
}
]
},
"vendor_name": "Apache Software Foundation"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Issue was discovered by Salt, \u003csaltnekoko AT gmail DOT com\u003e"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A carefully crafted request on XHRHtml2Markup.jsp could trigger an XSS vulnerability on Apache JSPWiki up to and including 2.11.2, which could allow the attacker to execute javascript in the victim\u0027s browser and get some sensitive information about the victim."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": [
{
"other": "moderate"
}
],
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-site scripting vulnerability on XHRHtml2Markup.jsp"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732",
"refsource": "MISC",
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2022-27166",
"datePublished": "2022-08-04T06:15:17.000Z",
"dateReserved": "2022-03-14T00:00:00.000Z",
"dateUpdated": "2024-08-03T05:18:39.251Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-24948 (GCVE-0-2022-24948)
Vulnerability from nvd – Published: 2022-02-25 08:30 – Updated: 2024-08-03 04:29
VLAI
EPSS
VEX
Title
Apache JSPWiki Cross-site scripting vulnerability on User Preferences screen
Summary
A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki, related to the user preferences screen, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.2 or later.
Severity
No CVSS data available.
CWE
- Cross-site scripting vulnerability on User Preferences screen
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/86p0yzopc4mw2h5bk… | x_refsource_MISC |
| http://www.openwall.com/lists/oss-security/2022/02/25/2 | mailing-listx_refsource_MLIST |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
Apache JSPWiki up to 2.11.1
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T04:29:01.128Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://lists.apache.org/thread/86p0yzopc4mw2h5bkwpt927b2c8tfq3b"
},
{
"name": "[oss-security] 20220225 [CVE-2022-24948] Apache JSPWiki Cross-site scripting vulnerability on User Preferences screen",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2022/02/25/2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"status": "affected",
"version": "Apache JSPWiki up to 2.11.1"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was discovered by Paulos Yibelo, from Octagon Networks."
}
],
"descriptions": [
{
"lang": "en",
"value": "A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki, related to the user preferences screen, which could allow the attacker to execute javascript in the victim\u0027s browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.2 or later."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-site scripting vulnerability on User Preferences screen",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-25T15:06:11.000Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://lists.apache.org/thread/86p0yzopc4mw2h5bkwpt927b2c8tfq3b"
},
{
"name": "[oss-security] 20220225 [CVE-2022-24948] Apache JSPWiki Cross-site scripting vulnerability on User Preferences screen",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2022/02/25/2"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache JSPWiki Cross-site scripting vulnerability on User Preferences screen",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"ID": "CVE-2022-24948",
"STATE": "PUBLIC",
"TITLE": "Apache JSPWiki Cross-site scripting vulnerability on User Preferences screen"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Apache JSPWiki",
"version": {
"version_data": [
{
"version_value": "Apache JSPWiki up to 2.11.1"
}
]
}
}
]
},
"vendor_name": "Apache Software Foundation"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was discovered by Paulos Yibelo, from Octagon Networks."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki, related to the user preferences screen, which could allow the attacker to execute javascript in the victim\u0027s browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.2 or later."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": [
{}
],
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-site scripting vulnerability on User Preferences screen"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://lists.apache.org/thread/86p0yzopc4mw2h5bkwpt927b2c8tfq3b",
"refsource": "MISC",
"url": "https://lists.apache.org/thread/86p0yzopc4mw2h5bkwpt927b2c8tfq3b"
},
{
"name": "[oss-security] 20220225 [CVE-2022-24948] Apache JSPWiki Cross-site scripting vulnerability on User Preferences screen",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2022/02/25/2"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2022-24948",
"datePublished": "2022-02-25T08:30:19.000Z",
"dateReserved": "2022-02-10T00:00:00.000Z",
"dateUpdated": "2024-08-03T04:29:01.128Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-24947 (GCVE-0-2022-24947)
Vulnerability from nvd – Published: 2022-02-25 08:30 – Updated: 2024-08-03 04:29
VLAI
EPSS
VEX
Title
Apache JSPWiki CSRF Account Takeover
Summary
Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later.
Severity
No CVSS data available.
CWE
- CSRF Account Takeover
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/txrgykjkpt80t57kz… | x_refsource_MISC |
| http://www.openwall.com/lists/oss-security/2022/02/25/1 | mailing-listx_refsource_MLIST |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
Apache JSPWiki up to 2.11.1
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T04:29:01.578Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://lists.apache.org/thread/txrgykjkpt80t57kzpbjo8kfrv8ss02c"
},
{
"name": "[oss-security] 20220225 [CVE-2022-24947] Apache JSPWiki CSRF Account Takeover",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2022/02/25/1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"status": "affected",
"version": "Apache JSPWiki up to 2.11.1"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was discovered initially by Cristian Borlovan from Ounce Labs Security (ref. JSPWIKI-79), and later on and independently from this by Paulos Yibelo, from Octagon Networks."
}
],
"descriptions": [
{
"lang": "en",
"value": "Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CSRF Account Takeover",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-25T15:06:13.000Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://lists.apache.org/thread/txrgykjkpt80t57kzpbjo8kfrv8ss02c"
},
{
"name": "[oss-security] 20220225 [CVE-2022-24947] Apache JSPWiki CSRF Account Takeover",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2022/02/25/1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache JSPWiki CSRF Account Takeover",
"workarounds": [
{
"lang": "en",
"value": "Installations \u003e= 2.7.0 can also enable user management workflows\u0027 manual approval to mitigate the issue."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"ID": "CVE-2022-24947",
"STATE": "PUBLIC",
"TITLE": "Apache JSPWiki CSRF Account Takeover"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Apache JSPWiki",
"version": {
"version_data": [
{
"version_value": "Apache JSPWiki up to 2.11.1"
}
]
}
}
]
},
"vendor_name": "Apache Software Foundation"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was discovered initially by Cristian Borlovan from Ounce Labs Security (ref. JSPWIKI-79), and later on and independently from this by Paulos Yibelo, from Octagon Networks."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": [
{}
],
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CSRF Account Takeover"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://lists.apache.org/thread/txrgykjkpt80t57kzpbjo8kfrv8ss02c",
"refsource": "MISC",
"url": "https://lists.apache.org/thread/txrgykjkpt80t57kzpbjo8kfrv8ss02c"
},
{
"name": "[oss-security] 20220225 [CVE-2022-24947] Apache JSPWiki CSRF Account Takeover",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2022/02/25/1"
}
]
},
"source": {
"discovery": "UNKNOWN"
},
"work_around": [
{
"lang": "en",
"value": "Installations \u003e= 2.7.0 can also enable user management workflows\u0027 manual approval to mitigate the issue."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2022-24947",
"datePublished": "2022-02-25T08:30:18.000Z",
"dateReserved": "2022-02-10T00:00:00.000Z",
"dateUpdated": "2024-08-03T04:29:01.578Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-48910 (GCVE-0-2026-48910)
Vulnerability from cvelistv5 – Published: 2026-07-30 15:56 – Updated: 2026-07-30 16:37
VLAI
EPSS
VEX
Title
Apache JSPWiki: Markdown parser allows XSS injection in Markdown error processing
Summary
A carefully crafted editing request could trigger an XSS vulnerability
on Apache JSPWiki when parsing errors on the markdown renderer, which
could allow the attacker to execute javascript in the victim's browser
and get some sensitive information about the victim.
This issue affects Apache JSPWiki: through 2.12.3.
Users are recommended to upgrade to version 2.12.4, which fixes the issue.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/yvbdjnocw5qq3xkbj… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/0… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
0 , ≤ 2.12.3
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-48910",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-30T16:36:48.479198Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T16:36:52.080Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-07-30T16:37:15.693Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/30/18"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.12.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Justin Ng from Cyver Security Agency of Singapore / Inland Reveue Authority of Singapore"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA carefully crafted editing request could trigger an XSS vulnerability \non Apache JSPWiki when parsing errors on the markdown renderer, which \ncould allow the attacker to execute javascript in the victim\u0027s browser \nand get some sensitive information about the victim.\n\u003c/p\u003e\u003cp\u003eThis issue affects Apache JSPWiki: through 2.12.3.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 2.12.4, which fixes the issue.\u003c/p\u003e"
}
],
"value": "A carefully crafted editing request could trigger an XSS vulnerability \non Apache JSPWiki when parsing errors on the markdown renderer, which \ncould allow the attacker to execute javascript in the victim\u0027s browser \nand get some sensitive information about the victim.\n\n\nThis issue affects Apache JSPWiki: through 2.12.3.\n\nUsers are recommended to upgrade to version 2.12.4, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T15:56:33.613Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/yvbdjnocw5qq3xkbjs9h77ghlg0bsw2c"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache JSPWiki: Markdown parser allows XSS injection in Markdown error processing",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-48910",
"datePublished": "2026-07-30T15:56:33.613Z",
"dateReserved": "2026-05-26T10:41:07.254Z",
"dateUpdated": "2026-07-30T16:37:15.693Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28814 (GCVE-0-2026-28814)
Vulnerability from cvelistv5 – Published: 2026-07-30 15:55 – Updated: 2026-07-31 17:55
VLAI
EPSS
VEX
Title
Apache JSPWiki: Pre-Authentication Arbitrary Wiki Markup Rendering
Summary
Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables.
Users are recommended to upgrade to version 2.12.4 or 3.0.0, which fixes this issue.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Arbitrary Wiki Markup rendering due to lack of authentication
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/8vv0311bvrrqxsyn9… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/0… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
0 , < 2.12.4
(semver)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-30T16:36:36.963Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/30/17"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-28814",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T17:55:52.115268Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T17:55:59.734Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "2.12.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Miguel Regala (Fisher) - Hadrian.io"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables.\u003cbr\u003eUsers are recommended to upgrade to version 2.12.4 or 3.0.0, which fixes this issue."
}
],
"value": "Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables.\nUsers are recommended to upgrade to version 2.12.4 or 3.0.0, which fixes this issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "critical"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Arbitrary Wiki Markup rendering due to lack of authentication",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T15:55:28.034Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/8vv0311bvrrqxsyn913pcwf7pctyk52w"
}
],
"source": {
"defect": [
"JSPWIKI-1270"
],
"discovery": "UNKNOWN"
},
"title": "Apache JSPWiki: Pre-Authentication Arbitrary Wiki Markup Rendering",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-28814",
"datePublished": "2026-07-30T15:55:28.034Z",
"dateReserved": "2026-03-03T15:02:10.764Z",
"dateUpdated": "2026-07-31T17:55:59.734Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28813 (GCVE-0-2026-28813)
Vulnerability from cvelistv5 – Published: 2026-07-30 15:54 – Updated: 2026-07-31 11:34
VLAI
EPSS
VEX
Title
Apache JSPWiki: JSPWiki vulnerable to JSON hijacking
Summary
Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities.
Users are recommended to upgrade to version 2.12.4, which fixes this issue.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/56440mymwkxt1hf3j… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/0… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
0 , < 2.12.4
(semver)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-30T16:36:34.389Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/30/16"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-28813",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T11:34:29.515111Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T11:34:33.218Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "2.12.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Janne Jalkannen from Apache JSPWiki"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities.\u003cbr\u003eUsers are recommended to upgrade to version 2.12.4, which fixes this issue."
}
],
"value": "Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities.\nUsers are recommended to upgrade to version 2.12.4, which fixes this issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T15:54:19.667Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/56440mymwkxt1hf3j8hjpo41yco7gotv"
}
],
"source": {
"defect": [
"JSPWIKI-175",
"JSPWIKI-1229",
"JSPWIKI-1262"
],
"discovery": "UNKNOWN"
},
"title": "Apache JSPWiki: JSPWiki vulnerable to JSON hijacking",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-28813",
"datePublished": "2026-07-30T15:54:19.667Z",
"dateReserved": "2026-03-03T15:01:42.672Z",
"dateUpdated": "2026-07-31T11:34:33.218Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28812 (GCVE-0-2026-28812)
Vulnerability from cvelistv5 – Published: 2026-07-30 15:52 – Updated: 2026-07-31 15:28
VLAI
EPSS
VEX
Title
Apache JSPWiki: UserManager does not sanity-check user database at startup
Summary
UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges.
Users are recommended to upgrade to version 2.12.4 or newer which fixes this issue.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- Use of impersonation
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/n3m666d6t6871dldv… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/0… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
0 , < 2.12.4
(semver)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-30T16:36:31.861Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/30/15"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-28812",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T15:28:05.878355Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T15:28:08.984Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "2.12.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Florian Holeczek from Apache JSPWiki"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges.\u003cbr\u003eUsers are recommended to upgrade to version 2.12.4 or newer which fixes this issue."
}
],
"value": "UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges.\nUsers are recommended to upgrade to version 2.12.4 or newer which fixes this issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Use of impersonation",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T15:52:34.172Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/n3m666d6t6871dldvz3ct49ooqkbgw2p"
}
],
"source": {
"defect": [
"JSPWIKI-130"
],
"discovery": "UNKNOWN"
},
"title": "Apache JSPWiki: UserManager does not sanity-check user database at startup",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-28812",
"datePublished": "2026-07-30T15:52:34.172Z",
"dateReserved": "2026-03-03T15:01:12.543Z",
"dateUpdated": "2026-07-31T15:28:08.984Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28811 (GCVE-0-2026-28811)
Vulnerability from cvelistv5 – Published: 2026-07-30 15:51 – Updated: 2026-07-31 17:54
VLAI
EPSS
VEX
Title
Apache JSPWiki: Error Handling - Reveals Error Details
Summary
Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3.
Users are recommended to upgrade to version 2.12.4, which fixes this issue.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-1295 - Debug Messages Revealing Unnecessary Information
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
0 , < up to 3.0.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-30T16:36:29.298Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/30/14"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-28811",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T17:53:53.456751Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T17:54:14.250Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "up to 3.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Cristian Borlovan from Ounce Labs"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3.\u003cbr\u003eUsers are recommended to upgrade to version 2.12.4, which fixes this issue."
}
],
"value": "Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3.\nUsers are recommended to upgrade to version 2.12.4, which fixes this issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "low"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1295",
"description": "CWE-1295 Debug Messages Revealing Unnecessary Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T15:51:27.131Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/2dm414zzjo3pvhjz6mvqy3b5yhvnkcg5"
},
{
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2026-28811"
}
],
"source": {
"defect": [
"JSPWIKI-75"
],
"discovery": "UNKNOWN"
},
"title": "Apache JSPWiki: Error Handling - Reveals Error Details",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-28811",
"datePublished": "2026-07-30T15:51:27.131Z",
"dateReserved": "2026-03-03T15:00:35.684Z",
"dateUpdated": "2026-07-31T17:54:14.250Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-24854 (GCVE-0-2025-24854)
Vulnerability from cvelistv5 – Published: 2025-07-31 08:43 – Updated: 2025-11-04 21:09
VLAI
EPSS
VEX
Title
Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Image plugin
Summary
A carefully crafted request using the Image plugin could trigger an XSS
vulnerability on Apache JSPWiki, which could allow the attacker to
execute javascript in the victim's browser and get some sensitive
information about the victim.
Apache JSPWiki users should upgrade to 2.12.3 or later.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
0 , ≤ 2.12.2
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-24854",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-31T13:38:50.896375Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-31T17:55:04.477Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T21:09:44.925Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2025/07/30/3"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.12.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The issue was separately discovered by both XBOW (https://github.com/xbow-security, https://xbow.com) and Hamed Kohi \u003c0x.hamy.1ATgmailDOTcom\u003e"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eA carefully crafted request using the Image plugin could trigger an XSS \nvulnerability on Apache JSPWiki, which could allow the attacker to \nexecute javascript in the victim\u0027s browser and get some sensitive \ninformation about the victim.\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eApache JSPWiki users should upgrade to 2.12.3 or later.\u003cbr\u003e\u003c/div\u003e"
}
],
"value": "A carefully crafted request using the Image plugin could trigger an XSS \nvulnerability on Apache JSPWiki, which could allow the attacker to \nexecute javascript in the victim\u0027s browser and get some sensitive \ninformation about the victim.\n\n\n\n\n\nApache JSPWiki users should upgrade to 2.12.3 or later."
}
],
"metrics": [
{
"other": {
"content": {
"text": "Medium"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-31T08:43:18.886Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2025-24854"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Image plugin",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2025-24854",
"datePublished": "2025-07-31T08:43:18.886Z",
"dateReserved": "2025-01-25T20:04:53.948Z",
"dateUpdated": "2025-11-04T21:09:44.925Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-24853 (GCVE-0-2025-24853)
Vulnerability from cvelistv5 – Published: 2025-07-31 08:42 – Updated: 2025-11-04 21:09
VLAI
EPSS
VEX
Title
Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Header Link processing
Summary
A carefully crafted request when creating a header link using the
wiki markup syntax, which could allow the attacker to execute javascript
in the victim's browser and get some sensitive information about the
victim.
Further research by the JSPWiki team showed that the markdown parser allowed this kind of attack too.
Apache JSPWiki users should upgrade to 2.12.3 or later.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
0 , ≤ 2.12.2
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-24853",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-31T13:39:02.510980Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-31T17:55:11.018Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T21:09:43.620Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2025/07/30/2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.12.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The issue was discovered by XBOW (https://github.com/xbow-security, https://xbow.com)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA carefully crafted request when creating a header link using the \nwiki markup syntax, which could allow the attacker to execute javascript\n in the victim\u0027s browser and get some sensitive information about the \nvictim.\n\u003c/p\u003e\n\u003cp\u003eFurther research by the JSPWiki team showed that the markdown parser allowed this kind of attack too.\u003c/p\u003e\u003cp\u003eApache JSPWiki users should upgrade to 2.12.3 or later.\u003cbr\u003e\u003c/p\u003e\u003cbr\u003e"
}
],
"value": "A carefully crafted request when creating a header link using the \nwiki markup syntax, which could allow the attacker to execute javascript\n in the victim\u0027s browser and get some sensitive information about the \nvictim.\n\n\n\nFurther research by the JSPWiki team showed that the markdown parser allowed this kind of attack too.\n\nApache JSPWiki users should upgrade to 2.12.3 or later."
}
],
"metrics": [
{
"other": {
"content": {
"text": "Medium"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-31T08:42:06.453Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2025-24853"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Header Link processing",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2025-24853",
"datePublished": "2025-07-31T08:42:06.453Z",
"dateReserved": "2025-01-25T20:03:15.418Z",
"dateUpdated": "2025-11-04T21:09:43.620Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-27136 (GCVE-0-2024-27136)
Vulnerability from cvelistv5 – Published: 2024-06-24 07:44 – Updated: 2025-03-20 18:03
VLAI
EPSS
VEX
Title
Apache JSPWiki: Cross-site scripting vulnerability on upload page
Summary
XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.2 or later.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/gfms8gbncqqkj52p8… | vendor-advisory |
| https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2024/06/23/3 |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
0 , ≤ 2.12.1
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-27136",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-24T13:27:24.688821Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-20T18:03:19.410Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-09-13T16:03:09.936Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.apache.org/thread/gfms8gbncqqkj52p861b8fnsypwsl1d5"
},
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2024-27136"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/06/23/3"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.12.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by sonnh from Vietnam National Cyber security technology corporation"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim\u0027s browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.2 or later. "
}
],
"value": "XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim\u0027s browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.2 or later. "
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-24T07:44:30.732Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/gfms8gbncqqkj52p861b8fnsypwsl1d5"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2024-27136"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache JSPWiki: Cross-site scripting vulnerability on upload page",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2024-27136",
"datePublished": "2024-06-24T07:44:30.732Z",
"dateReserved": "2024-02-20T12:13:15.203Z",
"dateUpdated": "2025-03-20T18:03:19.410Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-46907 (GCVE-0-2022-46907)
Vulnerability from cvelistv5 – Published: 2023-05-25 06:58 – Updated: 2025-02-13 16:33
VLAI
EPSS
VEX
Title
Apache JSPWiki: XSS Injection points in several plugins
Summary
A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.0 or later.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
0 , < Apache JSPWiki up to 2.12.0
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T14:47:27.792Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.apache.org/thread/1m0mkq2nttx8tn94m11mytn4f0tv1504"
},
{
"tags": [
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2023/05/25/1"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-46907",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-09T19:56:09.990171Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-09T19:56:24.015Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "Apache JSPWiki up to 2.12.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Eugene Lim and Sng Jay Kai from Government Technology Agency of Singapore"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim\u0027s browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.0 or later.\u003cbr\u003e"
}
],
"value": "A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim\u0027s browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.0 or later."
}
],
"metrics": [
{
"other": {
"content": {
"text": "Medium"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-25T07:00:09.411Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/1m0mkq2nttx8tn94m11mytn4f0tv1504"
},
{
"url": "http://www.openwall.com/lists/oss-security/2023/05/25/1"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Apache JSPWiki: XSS Injection points in several plugins",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2022-46907",
"datePublished": "2023-05-25T06:58:18.912Z",
"dateReserved": "2022-12-10T15:13:04.776Z",
"dateUpdated": "2025-02-13T16:33:58.435Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-34158 (GCVE-0-2022-34158)
Vulnerability from cvelistv5 – Published: 2022-08-04 06:16 – Updated: 2024-08-03 08:16
VLAI
EPSS
VEX
Title
User Group Privilege Escalation
Summary
A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege escalation of the attacker's account. Further examination of this issue established that it could also be used to modify the email associated with the attacked account, and then a reset password request from the login page.
Severity
No CVSS data available.
CWE
- CSRF group privilege escalation
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
unspecified , ≤ Apache JSPWiki up to 2.11.2
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T08:16:17.225Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-34158"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "Apache JSPWiki up to 2.11.2",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was discovered by Huiseong Seo (t0rchwo0d), \u003cawdr1624AT gmail DOT com\u003e"
}
],
"descriptions": [
{
"lang": "en",
"value": "A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege escalation of the attacker\u0027s account. Further examination of this issue established that it could also be used to modify the email associated with the attacked account, and then a reset password request from the login page."
}
],
"metrics": [
{
"other": {
"content": {
"other": "critical"
},
"type": "unknown"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CSRF group privilege escalation",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-08-04T06:16:11.000Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-34158"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "User Group Privilege Escalation",
"workarounds": [
{
"lang": "en",
"value": "Apache JSPWiki users should upgrade to 2.11.3 or later."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"ID": "CVE-2022-34158",
"STATE": "PUBLIC",
"TITLE": "User Group Privilege Escalation"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Apache JSPWiki",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "Apache JSPWiki up to 2.11.2"
}
]
}
}
]
},
"vendor_name": "Apache Software Foundation"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was discovered by Huiseong Seo (t0rchwo0d), \u003cawdr1624AT gmail DOT com\u003e"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege escalation of the attacker\u0027s account. Further examination of this issue established that it could also be used to modify the email associated with the attacked account, and then a reset password request from the login page."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": [
{
"other": "critical"
}
],
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CSRF group privilege escalation"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-34158",
"refsource": "MISC",
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-34158"
}
]
},
"source": {
"discovery": "UNKNOWN"
},
"work_around": [
{
"lang": "en",
"value": "Apache JSPWiki users should upgrade to 2.11.3 or later."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2022-34158",
"datePublished": "2022-08-04T06:16:11.000Z",
"dateReserved": "2022-06-20T00:00:00.000Z",
"dateUpdated": "2024-08-03T08:16:17.225Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-28732 (GCVE-0-2022-28732)
Vulnerability from cvelistv5 – Published: 2022-08-04 06:15 – Updated: 2024-08-03 06:03
VLAI
EPSS
VEX
Title
Apache JSPWiki Cross-site scripting vulnerability on WeblogPlugin
Summary
A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.3 or later.
Severity
No CVSS data available.
CWE
- XSS
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
Apache JSPWiki , ≤ Apache JSPWiki up to 2.11.2
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T06:03:52.589Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "Apache JSPWiki up to 2.11.2",
"status": "affected",
"version": "Apache JSPWiki",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was discovered by Wang Ran, from JDArmy, @jd.com"
}
],
"descriptions": [
{
"lang": "en",
"value": "A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim\u0027s browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.3 or later."
}
],
"metrics": [
{
"other": {
"content": {
"other": "moderate"
},
"type": "unknown"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "XSS",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-08-04T06:15:57.000Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache JSPWiki Cross-site scripting vulnerability on WeblogPlugin",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"ID": "CVE-2022-28732",
"STATE": "PUBLIC",
"TITLE": "Apache JSPWiki Cross-site scripting vulnerability on WeblogPlugin"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Apache JSPWiki",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "Apache JSPWiki",
"version_value": "Apache JSPWiki up to 2.11.2"
}
]
}
}
]
},
"vendor_name": "Apache Software Foundation"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was discovered by Wang Ran, from JDArmy, @jd.com"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim\u0027s browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.3 or later."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": [
{
"other": "moderate"
}
],
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "XSS"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732",
"refsource": "MISC",
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2022-28732",
"datePublished": "2022-08-04T06:15:57.000Z",
"dateReserved": "2022-04-05T00:00:00.000Z",
"dateUpdated": "2024-08-03T06:03:52.589Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-28731 (GCVE-0-2022-28731)
Vulnerability from cvelistv5 – Published: 2022-08-04 06:15 – Updated: 2024-08-03 06:03
VLAI
EPSS
VEX
Title
Apache JSPWiki CSRF in UserPreferences.jsp
Summary
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
Severity
No CVSS data available.
CWE
- CSRF Account Takeover
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
Apache JSPWiki , ≤ Apache JSPWiki up to 2.11.2
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T06:03:52.648Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "Apache JSPWiki up to 2.11.2",
"status": "affected",
"version": "Apache JSPWiki",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was discovered by Fabrice Perez, \u003cfabioperez AT gmail DOT com\u003e"
}
],
"descriptions": [
{
"lang": "en",
"value": "A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page."
}
],
"metrics": [
{
"other": {
"content": {
"other": "critical"
},
"type": "unknown"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CSRF Account Takeover",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-08-04T06:15:43.000Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache JSPWiki CSRF in UserPreferences.jsp",
"workarounds": [
{
"lang": "en",
"value": "Apache JSPWiki users should upgrade to 2.11.3 or later. Installations \u003e= 2.7.0 can also enable user management workflows\u0027 manual approval to mitigate the issue."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"ID": "CVE-2022-28731",
"STATE": "PUBLIC",
"TITLE": "Apache JSPWiki CSRF in UserPreferences.jsp"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Apache JSPWiki",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "Apache JSPWiki",
"version_value": "Apache JSPWiki up to 2.11.2"
}
]
}
}
]
},
"vendor_name": "Apache Software Foundation"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was discovered by Fabrice Perez, \u003cfabioperez AT gmail DOT com\u003e"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": [
{
"other": "critical"
}
],
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CSRF Account Takeover"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732",
"refsource": "MISC",
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
}
]
},
"source": {
"discovery": "UNKNOWN"
},
"work_around": [
{
"lang": "en",
"value": "Apache JSPWiki users should upgrade to 2.11.3 or later. Installations \u003e= 2.7.0 can also enable user management workflows\u0027 manual approval to mitigate the issue."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2022-28731",
"datePublished": "2022-08-04T06:15:43.000Z",
"dateReserved": "2022-04-05T00:00:00.000Z",
"dateUpdated": "2024-08-03T06:03:52.648Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-28730 (GCVE-0-2022-28730)
Vulnerability from cvelistv5 – Published: 2022-08-04 06:15 – Updated: 2024-08-03 06:03
VLAI
EPSS
VEX
Title
Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp
Summary
A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This vulnerability leverages CVE-2021-40369, where the Denounce plugin dangerously renders user-supplied URLs. Upon re-testing CVE-2021-40369, it appears that the patch was incomplete as it was still possible to insert malicious input via the Denounce plugin. Apache JSPWiki users should upgrade to 2.11.3 or later.
Severity
No CVSS data available.
CWE
- XSS
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
Apache JSPWiki , ≤ Apache JSPWiki up to 2.11.2
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T06:03:52.583Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "Apache JSPWiki up to 2.11.2",
"status": "affected",
"version": "Apache JSPWiki",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was discovered by Poh Jia Hao, from Star Labs \u003cinfo AT starlabs DOT sg\u003e"
}
],
"descriptions": [
{
"lang": "en",
"value": "A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim\u0027s browser and get some sensitive information about the victim. This vulnerability leverages CVE-2021-40369, where the Denounce plugin dangerously renders user-supplied URLs. Upon re-testing CVE-2021-40369, it appears that the patch was incomplete as it was still possible to insert malicious input via the Denounce plugin. Apache JSPWiki users should upgrade to 2.11.3 or later."
}
],
"metrics": [
{
"other": {
"content": {
"other": "moderate"
},
"type": "unknown"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "XSS",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-08-04T06:15:29.000Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"ID": "CVE-2022-28730",
"STATE": "PUBLIC",
"TITLE": "Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Apache JSPWiki",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "Apache JSPWiki",
"version_value": "Apache JSPWiki up to 2.11.2"
}
]
}
}
]
},
"vendor_name": "Apache Software Foundation"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was discovered by Poh Jia Hao, from Star Labs \u003cinfo AT starlabs DOT sg\u003e"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim\u0027s browser and get some sensitive information about the victim. This vulnerability leverages CVE-2021-40369, where the Denounce plugin dangerously renders user-supplied URLs. Upon re-testing CVE-2021-40369, it appears that the patch was incomplete as it was still possible to insert malicious input via the Denounce plugin. Apache JSPWiki users should upgrade to 2.11.3 or later."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": [
{
"other": "moderate"
}
],
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "XSS"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732",
"refsource": "MISC",
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2022-28730",
"datePublished": "2022-08-04T06:15:29.000Z",
"dateReserved": "2022-04-05T00:00:00.000Z",
"dateUpdated": "2024-08-03T06:03:52.583Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-27166 (GCVE-0-2022-27166)
Vulnerability from cvelistv5 – Published: 2022-08-04 06:15 – Updated: 2024-08-03 05:18
VLAI
EPSS
VEX
Title
XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2
Summary
A carefully crafted request on XHRHtml2Markup.jsp could trigger an XSS vulnerability on Apache JSPWiki up to and including 2.11.2, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Severity
No CVSS data available.
CWE
- Cross-site scripting vulnerability on XHRHtml2Markup.jsp
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki |
Affected:
Apache JSPWiki , ≤ Apache JSPWiki up to 2.11.2
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T05:18:39.251Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Apache JSPWiki",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "Apache JSPWiki up to 2.11.2",
"status": "affected",
"version": "Apache JSPWiki",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Issue was discovered by Salt, \u003csaltnekoko AT gmail DOT com\u003e"
}
],
"descriptions": [
{
"lang": "en",
"value": "A carefully crafted request on XHRHtml2Markup.jsp could trigger an XSS vulnerability on Apache JSPWiki up to and including 2.11.2, which could allow the attacker to execute javascript in the victim\u0027s browser and get some sensitive information about the victim."
}
],
"metrics": [
{
"other": {
"content": {
"other": "moderate"
},
"type": "unknown"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-site scripting vulnerability on XHRHtml2Markup.jsp",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-08-04T06:15:17.000Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"ID": "CVE-2022-27166",
"STATE": "PUBLIC",
"TITLE": "XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Apache JSPWiki",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "Apache JSPWiki",
"version_value": "Apache JSPWiki up to 2.11.2"
}
]
}
}
]
},
"vendor_name": "Apache Software Foundation"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Issue was discovered by Salt, \u003csaltnekoko AT gmail DOT com\u003e"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A carefully crafted request on XHRHtml2Markup.jsp could trigger an XSS vulnerability on Apache JSPWiki up to and including 2.11.2, which could allow the attacker to execute javascript in the victim\u0027s browser and get some sensitive information about the victim."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": [
{
"other": "moderate"
}
],
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-site scripting vulnerability on XHRHtml2Markup.jsp"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732",
"refsource": "MISC",
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2022-27166",
"datePublished": "2022-08-04T06:15:17.000Z",
"dateReserved": "2022-03-14T00:00:00.000Z",
"dateUpdated": "2024-08-03T05:18:39.251Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}