PT-2019-11427 · Apache · Apache Jspwiki

Dirk Frederickx · Publicado 2019-09-23 · Atualizado 2019-10-11 · CVE-2019-10090

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Apache JSPWiki versions prior to 2.11.0.M4

Description: A carefully crafted plugin link invocation could trigger an issue related to the plain editor, allowing an attacker to execute javascript in the victim's browser and potentially obtain sensitive information about the victim.

Recommendations: For versions prior to 2.11.0.M4, update to a version that contains a fix for this issue to prevent potential exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-10090

GHSA-G6WW-2X43-H963

Produtos afetados

Apache Jspwiki

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-10090 · Nota de Segurança
• https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10090 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-10090 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10090 · Nota
• https://osv.dev/vulnerability/GHSA-g6ww-2x43-h963 · Aviso do Fabricante