What is GHSA-cfqj-9g2g-w7q6?

GHSA-cfqj-9g2g-w7q6 is a security advisory published by GitHub Security Advisories with Medium severity. Apache JSPWiki Cross-site Scripting due to carefully crafted plugin link invocation

Which CVE IDs does GHSA-cfqj-9g2g-w7q6 cover?

GHSA-cfqj-9g2g-w7q6 covers the following CVE IDs: CVE-2021-40369. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cfqj-9g2g-w7q6?

GHSA-cfqj-9g2g-w7q6 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-cfqj-9g2g-w7q6?

GHSA-cfqj-9g2g-w7q6 affects 1 product, including: maven/org.apache.jspwiki:jspwiki-main:\u003c 2.11.0.

GHSA-cfqj-9g2g-w7q6MediumCVSS 6.1

Apache JSPWiki Cross-site Scripting due to carefully crafted plugin link invocation

Vendor

GitHub Security Advisories

Published

December 2, 2021

Last Modified

January 30, 2023

🔗 CVE IDs covered (1)

CVE-2021-40369 →

📋 Description

A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.0 or later.

🎯 Affected products1

maven/org.apache.jspwiki:jspwiki-main:< 2.11.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2021-40369
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2021-40369
https://lists.apache.org/thread/r2j00nrnpjgcmoxvlv3pgfoq9kzrcsfh
http://www.openwall.com/lists/oss-security/2022/08/03/3
https://github.com/advisories/GHSA-cfqj-9g2g-w7q6