CVE Vulnerability

CVE-2021-40369

A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.0 or later.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

6.1 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://lists.apache.org/thread/r2j00nrnpjgcmoxvlv3pgfoq9kzrcsfh Vendor Advisory
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2021-40369 Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/08/03/3 Mailing List Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:apache:jspwiki:*:*:*:*:*:*:*:*
Information

Published : 2021-11-24 12:15

Updated : 2022-11-09 09:43

NVD link : CVE-2021-40369

Mitre link : CVE-2021-40369

Products Affected
No products.
CWE
CWE-79