Vulnerability · Published Jul 6, 2022 · Assigned by apache
CVE-2022-32533Apache Portals Jetspeed XSS, CSRF, SSRF, and XXE issues
Critical 9.8
In plain English
A critical-severity cross-site scripting in Apache Portals from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.2% (higher than 91% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)4.2%top 9.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant project of Apache Portals and no updates will be provided for this issue
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.portals.jetspeed-2:jetspeed-commons | no fix listed | GHSA-h975-r69h-4w9p |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Portals | Jetspeed 2.3.1 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://lists.apache.org/thread/d3g248pr03x8rvmh8p2t3xdlw0wn5dz2 x_refsource_MISC
- https://www.openwall.com/lists/oss-security/2022/07/06/1 x_refsource_MISC
- [oss-security] 20220706 CVE-2022-32533: Apache Portals Jetspeed XSS, CSRF, SSRF, and XXE issues mailing-list, x_refsource_MLIST