PT-2023-15104 · Apache · Apache Jspwiki

Eugene Lim + 1 · Publicado 2023-05-25 · Atualizado 2023-06-01 · CVE-2022-46907

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache JSPWiki versions prior to 2.12.0

Description A carefully crafted request on several JSPWiki plugins could trigger an issue that allows the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

Recommendations For versions prior to 2.12.0, upgrade to 2.12.0 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2022-46907

GHSA-QVQ8-CW7F-M7M4

Produtos afetados

Apache Jspwiki

Referências · 16

• https://github.com/apache/jspwiki · Nota
• https://github.com/apache/jspwiki/commit/484c6a133e397693991b7c9a9b62ef3ca48ce707 · Nota
• https://github.com/apache/jspwiki/commit/0b9a0149032170063f22d65e335dfd317db815ea · Nota
• https://github.com/apache/jspwiki/commit/9d6dbf911d52d724297e4e46c4b80649fb028ff9 · Nota
• https://github.com/apache/jspwiki/commit/df20770f251a8d7431047e556b144ef24ee6a3a7 · Nota
• https://github.com/apache/jspwiki/commit/75019d337f1d0033b1f65428e75f43baeffd99dd · Nota
• https://github.com/apache/jspwiki/commit/46e1ef7a595ca5cabf5ef184139910413f2024fc · Nota
• https://github.com/apache/jspwiki/blob/37bf55373ed5a739a388a720163cf51d1104537f/ChangeLog.md?plain=1#L112 · Nota
• https://github.com/apache/jspwiki/commit/82be08904a6d8bd22fa2d4e5a7e85f43408724d3 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46907 · Nota
• https://osv.dev/vulnerability/GHSA-qvq8-cw7f-m7m4 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2022-46907 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-46907 · Nota de Segurança
• https://lists.apache.org/thread/1m0mkq2nttx8tn94m11mytn4f0tv1504 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2023/05/25/1 · Nota