Cross-site Scriptin in JSPWiki

A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable.

Vulnerability ID: GHSA-hp5r-mhgp-56c9
Aliases: CVE-2019-10078
Published: 2019-06-06 15:29:29
CWE: CWE-79
Severity rating: MODERATE
CVSS: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Maven
name: org.apache.jspwiki:jspwiki-war
package: ecosystem: Maven
name: org.apache.jspwiki:jspwiki-main