GHSA-hp5r-mhgp-56c9
Cross-site Scriptin in JSPWiki
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.apache.jspwiki:jspwiki-war | >= 2.9.0, < 2.11.0.M4 | 2.11.0.M4 |
| Maven | org.apache.jspwiki:jspwiki-main | >= 2.9.0, < 2.11.0.M4 | 2.11.0.M4 |
Details
As written in the advisory (Markdown source, shown as plain text).
A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable.
References
External links from the advisory. They lead to third-party sites.