GHSA-8gw6-w5rw-4g5cCriticalCVSS 9.1

Incorrect Default Permissions in Apache JSPWiki

Published
November 29, 2021
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-44140 →

📋 Description

Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later.

🎯 Affected products1

  • maven/org.apache.jspwiki:jspwiki-main:< 2.11.0

🔗 References (4)