Vulnerability · Published Jul 31, 2025 · Assigned by apache
CVE-2025-24853Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Header Link processing
High 7.5
In plain English
A high-severity cross-site scripting in Apache JSPWiki from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Further research by the JSPWiki team showed that the markdown parser allowed this kind of attack too. Apache JSPWiki users should upgrade to 2.12.3 or later.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.jspwiki:jspwiki-main | 2.12.3 | GHSA-rrff-chj9-w4c7 |
| Maven | org.apache.jspwiki:jspwiki-markdown | 2.12.3 | GHSA-rrff-chj9-w4c7 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache JSPWiki | 0 – through 2.12.2 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N