PT-2019-4411 · Apache · Apache Jspwiki

Jamie Parfet · Published 2019-01-30 · Updated 2019-05-19 · CVE-2018-20242

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache JSPWiki versions up to 2.10.5

Description The issue is related to a lack of protection measures for the web page structure in Apache JSPWiki, based on JSP technology. A carefully crafted URL could trigger a session hijacking issue. Exploitation of this issue may allow a remote attacker to perform a cross-site scripting attack using a specially crafted link.

Recommendations For Apache JSPWiki versions up to 2.10.5, consider disabling access to potentially vulnerable URLs as a temporary workaround until a patch is available. Restrict access to sensitive areas of the web application to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-00138

CVE-2018-20242

GHSA-5Q75-CXCQ-WR26

Affected Products

Apache Jspwiki

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2018-20242 · Security Note
• https://osv.dev/vulnerability/CVE-2018-20242 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00138 · Security Note
• https://osv.dev/vulnerability/GHSA-5q75-cxcq-wr26 · Vendor Advisory
• https://lists.apache.org/thread.html/8ee4644432c0a433c5c514a57d940cf6dcb0a0094acd97b36290f0b4%40%3Cuser.jspwiki.apache.org%3E · Note
• https://lists.apache.org/thread.html/8ee4644432c0a433c5c514a57d940cf6dcb0a0094acd97b36290f0b4@%3Cuser.jspwiki.apache.org%3E · Note
• https://lists.apache.org/thread.html/e42d6e93384d4a33e939989cd00ea2a06ccf1e7bb1e6bdd3bf5187c1@%3Ccommits.jspwiki.apache.org%3E · Note
• https://github.com/advisories/GHSA-5q75-cxcq-wr26 · Note
• https://lists.apache.org/thread.html/aac253cfc33c0429b528e2fcbe82d3a42d742083c528f58d192dfd16%40%3Ccommits.jspwiki.apache.org%3E · Note
• https://lists.apache.org/thread.html/aac253cfc33c0429b528e2fcbe82d3a42d742083c528f58d192dfd16@%3Ccommits.jspwiki.apache.org%3E · Note
• https://lists.apache.org/thread.html/e42d6e93384d4a33e939989cd00ea2a06ccf1e7bb1e6bdd3bf5187c1%40%3Ccommits.jspwiki.apache.org%3E · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20242 · Note
• http://securityfocus.com/bid/106804 · Note