PT-2022-19198 · Apache · Apache Jspwiki

Poh Jia + 1 · Published 2022-08-04 · Updated 2022-08-10 · CVE-2022-28730

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache JSPWiki versions prior to 2.11.3

Description A carefully crafted request on "AJAXPreview.jsp" could trigger an issue that allows an attacker to execute javascript in the victim's browser and obtain sensitive information. This issue leverages a problem where the Denounce plugin dangerously renders user-supplied URLs. The patch for this problem was found to be incomplete, as it was still possible to insert malicious input via the Denounce plugin.

Recommendations For versions prior to 2.11.3, upgrade to 2.11.3 or later. As a temporary workaround, consider disabling the Denounce plugin until a patch is available. Restrict access to the "AJAXPreview.jsp" page to minimize the risk of exploitation. Avoid using the Denounce plugin to render user-supplied URLs until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-28730

GHSA-GGJQ-8C4C-68R5

Affected Products

Apache Jspwiki

References · 7

• https://osv.dev/vulnerability/GHSA-ggjq-8c4c-68r5 · Vendor Advisory
• https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-28730 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28730 · Security Note
• https://github.com/apache/jspwiki · Note
• https://t.me/cvenotify/34234 · Telegram Post
• https://t.me/cibsecurity/47538 · Telegram Post