Apache JSPWiki vulnerable to cross-site scripting on several plugins

A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.0 or later.


Vulnerability ID: GHSA-qvq8-cw7f-m7m4
Aliases: CVE-2022-46907
Published: 2023-05-25 09:30:25
CWE: CWE-79
Severity rating: MODERATE
CVSS: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Maven
name: org.apache.jspwiki:jspwiki-main
package: ecosystem: Maven
name: org.apache.jspwiki:jspwiki-war