CVE-2024-27136mediumCWE-79

CVE-2024-27136: medium-severity vulnerability in Apache JSPWiki

Apache JSPWiki: Cross-site scripting vulnerability on upload page

Published · Updated

Follow this CVE+ Monitor Apache JSPWiki+ Monitor org.apache.jspwiki:jspwiki-main

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

25Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 61%
XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.2 or later.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Apache Software Foundation · Apache JSPWiki
Related CVEs — Apache JSPWiki

In the same product, most dangerous first.

CVE-2022-28730—Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jspEPSS 86.2%CVE-2022-27166—XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2EPSS 86.2%CVE-2022-28732—Apache JSPWiki Cross-site scripting vulnerability on WeblogPluginEPSS 82.8%CVE-2022-28731—Apache JSPWiki CSRF in UserPreferences.jspEPSS 58.7%CVE-2021-44140—Arbitrary file deletion on logoutEPSS 6.4%CVE-2018-20242—CVE-2018-20242EPSS 5.4%