CVE-2019-0186
CVE-2019-0186
The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks. Mitigation: * Uninstall the ChatRoomDemo war file - or - * migrate to version 3.1.0 of the chat-room-demo war file
Affected products
Apache Software Foundation · Apache Plutopublic PoCs found — 3
cve_referencepacketstormsecurity.com/files/152642/Apache-Pluto-3.0.0-3.0.1-Cross-Site-Scripting.htmlunverifiedcve_referencewww.exploit-db.com/exploits/46759/unverifiedexploitdbwww.exploit-db.com/exploits/46759unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
http://mail-archives.apache.org/mod_mbox/portals-pluto-user/201904.mbox/%3CCAAqbB_ev=0KNgZmmNAq2=q11i1GYLGN6J-xCKx8Q8dbxZ4tZYg%40mail.gmail.com%3Ehttp://packetstormsecurity.com/files/152642/Apache-Pluto-3.0.0-3.0.1-Cross-Site-Scripting.htmlhttps://lists.apache.org/thread.html/d093e6b0e5f9b3b50928255451afefd8f8fbdcd5bf28a726769a919a%40%3Cpluto-user.portals.apache.org%3Ehttps://portals.apache.org/pluto/security.htmlhttps://www.exploit-db.com/exploits/46759/https://www.openwall.com/lists/oss-security/2019/04/25/8http://www.securityfocus.com/bid/108091