QwikSec

Security Database

CVE

CWE

Training

CVE-2021-40369

Published: Nov 24, 2021

Modified: Aug 4, 2024

PUBLISHED

Description

A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.0 or later.

Vendor	Product	Versions
Apache Software Foundation	Apache JSPWiki	affected `Apache JSPWiki - <= 2.11.0.M8`

References

https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2021-40369

x_refsource_MISC

https://lists.apache.org/thread/r2j00nrnpjgcmoxvlv3pgfoq9kzrcsfh

x_refsource_MISC

[oss-security] 20220803 CVE-2022-28730: Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.