Cross-site scripting in Apache JSPWiki
Priority LOW 36CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking.
Why it matters now
EPSS 0.05364 92nd percentileScored 2026-11-07
Fix Fixed Apache JSPWiki (Apache Software Foundation): 2.10.5org.apache.jspwiki:jspwiki-war (Maven): 2.11.0.M1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache JSPWiki | before 2.10.5 | 2.10.5 | Patch available | CNA |
| — | org.apache.jspwiki:jspwiki-war (Maven) | before 2.11.0.M1 | 2.11.0.M1 | Patch available | GHSA-5q75-cxcq-wr26 |
- Apache JSPWiki VendorApache Affected before 2.10.5 Fixed in 2.10.5 Patch available CNA
- org.apache.jspwiki:jspwiki-war (Maven) Vendor— Affected before 2.11.0.M1 Fixed in 2.11.0.M1 Patch available GHSA-5q75-cxcq-wr26
Remediation
- Fix · CNA Apache JSPWiki (Apache Software Foundation) Fixed in 2.10.5
- Fix · GHSA-5q75-cxcq-wr26 org.apache.jspwiki:jspwiki-war (Maven) Fixed in 2.11.0.M1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2018-20242
- 2026-10-03 Alias added: GHSA-5q75-cxcq-wr26
References
Advisory 2
Other 6
- [user] 20190130 [CVE-2018-20242] Apache JSPWiki Cross-site scripting vulnerability onApache JSPWiki
- [jspwiki-commits] 20190329 [jspwiki-site] branch jbake updated: add CVE-2019-0224 and CVE-2019-0225 vulnerability disclosures
- [jspwiki-commits] 20190519 [jspwiki-site] branch jbake updated: added CVE-2019-10076, CVE-2019-10077 and CVE-2019-10078 vulnerability disclosures
- https://lists.apache.org/thread.html/8ee4644432c0a433c5c514a57d940cf6dcb0a0094acd97b36290f0b4@%3Cuser.jspwiki.apache.org%3E
- https://lists.apache.org/thread.html/aac253cfc33c0429b528e2fcbe82d3a42d742083c528f58d192dfd16@%3Ccommits.jspwiki.apache.org%3E
- https://lists.apache.org/thread.html/e42d6e93384d4a33e939989cd00ea2a06ccf1e7bb1e6bdd3bf5187c1@%3Ccommits.jspwiki.apache.org%3E
More Apache Jspwiki vulnerabilities
- TI-2022-11364 Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp CVSS 3.1MEDIUM 6.1
- TI-2022-10292 XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2 CVSS 3.1MEDIUM 6.1
- TI-2022-11366 Apache JSPWiki Cross-site scripting vulnerability on WeblogPlugin CVSS 3.1MEDIUM 6.1
- TI-2022-11365 Apache JSPWiki CSRF in UserPreferences.jsp CVSS 3.1MEDIUM 6.5
- TI-2024-17991 Apache JSPWiki: Cross-site scripting vulnerability on upload page CVSS 3.1MEDIUM 6.1
- TI-2026-23006 Apache JSPWiki: UserManager does not sanity-check user database at startup CVSS 3.1CRITICAL 9.8
Sources
- CVE-2018-20242 · CVE Program
- CVE-2018-20242 · NVD
- FIRST EPSS
- GHSA-5q75-cxcq-wr26 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences