Cross-Site Scripting in JSPWiki

A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.

Vulnerability ID: GHSA-cxx2-fp39-rf3r
Aliases: CVE-2019-10076
Published: 2019-06-06 15:29:22
CWE: CWE-79
Severity rating: MODERATE
CVSS: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Maven
name: org.apache.jspwiki:jspwiki-war
package: ecosystem: Maven
name: org.apache.jspwiki:jspwiki-main