Vulnerability · Published Aug 4, 2022 · Assigned by apache
CVE-2022-28730Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp
Medium 6.1
In plain English
A medium-severity security flaw in Apache JSPWiki from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 86.2% (higher than 99.7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This vulnerability leverages CVE-2021-40369, where the Denounce plugin dangerously renders user-supplied URLs. Upon re-testing CVE-2021-40369, it appears that the patch was incomplete as it was still possible to insert malicious input via the Denounce plugin. Apache JSPWiki users should upgrade to 2.11.3 or later.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.jspwiki:jspwiki-main | 2.11.3 | GHSA-ggjq-8c4c-68r5 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache JSPWiki | Apache JSPWiki – through Apache JSPWiki up to 2.11.2 |
References
- https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732 x_refsource_MISC