PT-2019-11424 · Apache · Apache Allura

Published 2019-06-18 · Updated 2019-06-19 · CVE-2019-10085

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Apache Allura versions prior to 1.11.0

Description: A stored XSS issue exists in the user dropdown selector when creating or editing tickets. The XSS executes when a user interacts with the dropdown on the affected page.

Recommendations: For versions prior to 1.11.0, update to version 1.11.0 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-10085

Affected Products

Apache Allura

References · 5

• https://osv.dev/vulnerability/CVE-2019-10085 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10085 · Security Note
• https://lists.apache.org/thread.html/9a20914c4251a2ae3caebd8d0dd0056f3ac89209d6c216bb89efabd9%40%3Cannounce.apache.org%3E · Note
• https://lists.apache.org/thread.html/88c064c95da2f41d5435ca5b3e364925bed72cc73bcec9b3f25e4c07%40%3Cdev.allura.apache.org%3E · Note
• http://securityfocus.com/bid/108816 · Note