6.1

CVE-2019-10089

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the WYSIWYG editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

Data is provided by the National Vulnerability Database (NVD)
Apache ≫ Jspwiki Version <= 2.10.5
Apache ≫ Jspwiki Version2.11.0 Updatem1
Apache ≫ Jspwiki Version2.11.0 Updatem1-rc1
Apache ≫ Jspwiki Version2.11.0 Updatem1-rc2
Apache ≫ Jspwiki Version2.11.0 Updatem1-rc3
Apache ≫ Jspwiki Version2.11.0 Updatem2
Apache ≫ Jspwiki Version2.11.0 Updatem2-rc1
Apache ≫ Jspwiki Version2.11.0 Updatem3
Apache ≫ Jspwiki Version2.11.0 Updatem3-rc1
Apache ≫ Jspwiki Version2.11.0 Updatem3-rc2
Apache ≫ Jspwiki Version2.11.0 Updatem4
Apache ≫ Jspwiki Version2.11.0 Updatem4-rc1
Apache ≫ Jspwiki Version2.11.0 Updatem4-rc2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 5.16% 0.889
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.