CVE-2022-24948

· MEDIUMModified

← All CVEs

CVSS v3.1

6.1

EPSS

2.25%

Published

Feb 25, 2022

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki, related to the user preferences screen, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.2 or later.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

Affected Products (1)

apache · jspwiki (up to 2.11.2)vulnerable

References (4)

http://www.openwall.com/lists/oss-security/2022/02/25/2

Mailing ListThird Party Advisory

https://lists.apache.org/thread/86p0yzopc4mw2h5bkwpt927b2c8tfq3b

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2022/02/25/2

Mailing ListThird Party Advisory

https://lists.apache.org/thread/86p0yzopc4mw2h5bkwpt927b2c8tfq3b

Mailing ListVendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs