PT-2021-20074 · Apache · Apache Jena Fuseki

Luka Safonov · Published 2021-07-05 · Updated 2021-08-13 · CVE-2021-33192

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Jena Fuseki versions 2.0.0 through 4.0.0

Description A vulnerability in the HTML pages of Apache Jena Fuseki allows an attacker to execute arbitrary javascript on certain page views.

Recommendations For versions 2.0.0 through 4.0.0, consider disabling javascript execution on HTML pages as a temporary workaround until a patch is available. Restrict access to the HTML pages of Apache Jena Fuseki to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-33192

GHSA-PHWJ-86VX-CFJC

Affected Products

Apache Jena Fuseki

References · 12

• https://lists.apache.org/thread.html/r684d8943d755a96fe90f8cd8df196737b6bde3f2b74e15a9bd479975%40%3Cusers.jena.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-33192 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-33192 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33192 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-33192 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33192 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-33192 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-phwj-86vx-cfjc · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-33192 · Security Note
• https://lists.apache.org/thread/sq6q94q0prqwr9vdm2wptglcq1kv98k8 · Note
• https://t.me/cvenotify/17102 · Telegram Post
• https://t.me/cvenotify/17069 · Telegram Post