VulnerabilityModified
CVE-2019-10078
A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
MEDIUM 6.1EPSS 4.94%
Does this matter?
Lower severity and a low EPSS score (4.94%). Track it; it rarely justifies an emergency change on its own.
Description
A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable.
- CVSS 3.0
- 6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 4.94% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- apache/jspwiki
- Source
- security@apache.org
References
- http://www.openwall.com/lists/oss-security/2019/05/19/6
- http://www.securityfocus.com/bid/108437
- https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10078Vendor Advisory
- https://lists.apache.org/thread.html/24f324ef11e43ba89ec9aac3725a5ecd4289835639c476299e7660d9%40%3Cdev.jspwiki.apache.org%3E
- https://lists.apache.org/thread.html/959811b776e1a332a1a4295405b683fd64190d079a7c3028f1c314d7%40%3Cdev.jspwiki.apache.org%3E
- https://lists.apache.org/thread.html/aac253cfc33c0429b528e2fcbe82d3a42d742083c528f58d192dfd16%40%3Ccommits.jspwiki.apache.org%3E
- http://www.openwall.com/lists/oss-security/2019/05/19/6
- http://www.securityfocus.com/bid/108437
- https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10078Vendor Advisory
- https://lists.apache.org/thread.html/24f324ef11e43ba89ec9aac3725a5ecd4289835639c476299e7660d9%40%3Cdev.jspwiki.apache.org%3E
- https://lists.apache.org/thread.html/959811b776e1a332a1a4295405b683fd64190d079a7c3028f1c314d7%40%3Cdev.jspwiki.apache.org%3E
- https://lists.apache.org/thread.html/aac253cfc33c0429b528e2fcbe82d3a42d742083c528f58d192dfd16%40%3Ccommits.jspwiki.apache.org%3E
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.