Aller au contenu
en Se connecter
Non notée

CVE-2022-28730 A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow…

Description

A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This vulnerability leverages CVE-2021-40369, where the Denounce plugin dangerously renders user-supplied URLs. Upon re-testing CVE-2021-40369, it appears that the patch was incomplete as it was still possible to insert malicious input via the Denounce plugin. Apache JSPWiki users should upgrade to 2.11.3 or later.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache JSPWiki Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache JSPWiki

Les 22 CVE de Apache JSPWiki →
CVE-2026-48910 A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the… Non notée CVE-2026-28814 Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain… Non notée CVE-2026-28813 Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities Non notée CVE-2026-28812 UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate… Non notée
Suivre cette CVE