Vulnerability Database

290,018

Total vulnerabilities in the database

CVE-2019-10078

A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable.

CVSS v3:

  • Severity: Medium
  • Score: 6.1
  • AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2:

  • Severity: Low
  • Score: 4.3
  • AV:N/AC:M/Au:N/C:N/I:P/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
apache / jspwiki 2.9.0 2.11.0.x
apache / jspwiki 2.11.0-m1-rc2 2.11.0-m1-rc2.x
apache / jspwiki 2.11.0-m1.rc3 2.11.0-m1.rc3.x
apache / jspwiki 2.11.0-m1 2.11.0-m1.x
apache / jspwiki 2.11.0-m2-rc1 2.11.0-m2-rc1.x
apache / jspwiki 2.11.0-m2 2.11.0-m2.x
apache / jspwiki 2.11.0-m1-rc1 2.11.0-m1-rc1.x
org.apache.jspwiki / jspwiki-war 2.9.0 2.11.0.M4
org.apache.jspwiki / jspwiki-main 2.9.0 2.11.0.M4