PT-2022-21354 · Apache · Apache Jetspeed-2

Runningsnail + 1 · Published 2022-07-06 · Updated 2024-08-03 · CVE-2022-32533

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Jetspeed-2 (affected versions not specified)

Description The issue arises from insufficient filtering of untrusted user input by default, leading to problems such as XSS, CSRF, XXE, and SSRF. Setting the configuration option xss.filter.post = true may help mitigate these issues. It's noted that Apache Jetspeed is a dormant project of Apache Portals, and no updates will be provided for this issue.

Recommendations As a temporary workaround, consider setting the configuration option xss.filter.post = true to mitigate the issues. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

XSS

CSRF

XXE

Weakness Enumeration

CWE-918

CWE-79

CWE-352

CWE-611

Related Identifiers

CVE-2022-32533

GHSA-H975-R69H-4W9P

Affected Products

Apache Jetspeed-2

References · 9

• https://lists.apache.org/thread/d3g248pr03x8rvmh8p2t3xdlw0wn5dz2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32533 · Security Note
• https://osv.dev/vulnerability/GHSA-h975-r69h-4w9p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-32533 · Vendor Advisory
• https://t.me/cvenotify/88734 · Telegram Post
• https://t.me/cibsecurity/45627 · Telegram Post
• https://openwall.com/lists/oss-security/2022/07/06/1 · Note
• http://openwall.com/lists/oss-security/2022/07/06/1 · Note
• https://t.me/cvenotify/32652 · Telegram Post