CVE-2019-12404

Опубликовано: 23 сент. 2019

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to InfoContent.jsp, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

Ссылки

https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-12404
Vendor Advisory
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-12404
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:jspwiki:*:*:*:*:*:*:*:*

Версия до 2.10.5 (включая)

cpe:2.3:a:apache:jspwiki:2.11.0:m1:*:*:*:*:*:*

cpe:2.3:a:apache:jspwiki:2.11.0:m1-rc1:*:*:*:*:*:*

cpe:2.3:a:apache:jspwiki:2.11.0:m1-rc2:*:*:*:*:*:*

cpe:2.3:a:apache:jspwiki:2.11.0:m1-rc3:*:*:*:*:*:*

cpe:2.3:a:apache:jspwiki:2.11.0:m2:*:*:*:*:*:*

cpe:2.3:a:apache:jspwiki:2.11.0:m2-rc1:*:*:*:*:*:*

cpe:2.3:a:apache:jspwiki:2.11.0:m3:*:*:*:*:*:*

cpe:2.3:a:apache:jspwiki:2.11.0:m3-rc1:*:*:*:*:*:*

cpe:2.3:a:apache:jspwiki:2.11.0:m3-rc2:*:*:*:*:*:*

cpe:2.3:a:apache:jspwiki:2.11.0:m4:*:*:*:*:*:*

cpe:2.3:a:apache:jspwiki:2.11.0:m4-rc1:*:*:*:*:*:*

cpe:2.3:a:apache:jspwiki:2.11.0:m4-rc2:*:*:*:*:*:*

EPSS

Процентиль: 89%

0.04421

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2019-12404

CVSS3: 6.1

ubuntu

больше 6 лет назад

CVE-2019-12404

CVSS3: 6.1

debian

больше 6 лет назад

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin ...

GHSA-7qmg-qg53-mrp8

CVSS3: 6.1

github

больше 6 лет назад

Cross-site scripting in Apache JSPWiki

EPSS

Процентиль: 89%

0.04421

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79