Vulnerability · Published Jan 6, 2022 · Assigned by apache
CVE-2021-36739XSS vulnerability in the MVCBean JSP portlet maven archetype
Medium 6.1
In plain English
A medium-severity cross-site scripting in Apache Portals from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)2.4%top 15.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The "first name" and "last name" fields of the Apache Pluto 3.1.0 MVCBean JSP portlet maven archetype are vulnerable to Cross-Site Scripting (XSS) attacks.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.portals.pluto:pluto-portal | 3.1.1 | GHSA-3qp6-m7hp-jrwf |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Portals | org.apache.portals.pluto.archetype:mvcbean-jsp-portlet-archetype 3.1.0 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://lists.apache.org/thread/m5j87nn1lmvzp8b9lmh7gqq68g5lnb7p x_refsource_MISC