CVE-2024-27136
6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.2 or later.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache JSPWiki | 0 <= 2.12.1 | affected |
Weaknesses
- CWE-79: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
CVE Program Container
Additional References
- https://lists.apache.org/thread/gfms8gbncqqkj52p861b8fnsypwsl1d5
- https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2024-27136
- http://www.openwall.com/lists/oss-security/2024/06/23/3
References
- https://lists.apache.org/thread/gfms8gbncqqkj52p861b8fnsypwsl1d5
- https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2024-27136
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.