Cross-site scripting in Apache Pluto
Priority MEDIUM 46CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks. Mitigation: * Uninstall the ChatRoomDemo war file - or - * migrate to version 3.1.0 of the chat-room-demo war file
Why it matters now
EPSS 0.20649 97th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA and NVD
Fix Fixed org.apache.portals.pluto:chatRoomDemo (Maven): 3.1.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Pluto | 3.0.0; 3.0.1 | — | No fix listed | CNA |
| — | org.apache.portals.pluto:chatRoomDemo (Maven) | 3.0.0 to before 3.1.0 | 3.1.0 | Patch available | GHSA-w47g-4vrc-m3w2 |
- Apache Pluto VendorApache Affected 3.0.0; 3.0.1 Fixed in — No fix listed CNA
- org.apache.portals.pluto:chatRoomDemo (Maven) Vendor— Affected 3.0.0 to before 3.1.0 Fixed in 3.1.0 Patch available GHSA-w47g-4vrc-m3w2
Remediation
- Fix · GHSA-w47g-4vrc-m3w2 org.apache.portals.pluto:chatRoomDemo (Maven) Fixed in 3.1.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-0186
- 2026-10-03 Alias added: GHSA-w47g-4vrc-m3w2
References
Exploit 2
Advisory 3
Other 5
- [CVE-2019-0186] The input fields of the Chat Room demo are vulnerable to Cross-Site Scripting (XSS) attacks
- [CVE-2019-0186] The input fields of the Chat Room demo are vulnerable to Cross-Site Scripting (XSS) attacks
- https://lists.apache.org/thread.html/d093e6b0e5f9b3b50928255451afefd8f8fbdcd5bf28a726769a919a@%3Cpluto-user.portals.apache.org%3E
- https://www.exploit-db.com/exploits/46759
- http://mail-archives.apache.org/mod_mbox/portals-pluto-user/201904.mbox/%3CCAAqbB_ev=0KNgZmmNAq2=q11i1GYLGN6J-xCKx8Q8dbxZ4tZYg@mail.gmail.com%3E
More Apache Pluto vulnerabilities
- TI-2018-01209 Information disclosure in Apache Pluto CVSS 3.0HIGH 7.5
- TI-2021-14865 XSS vulnerability in the MVCBean JSP portlet maven archetype CVSS 3.1MEDIUM 6.1
- TI-2021-14864 XSS vulnerability in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet CVSS 3.1MEDIUM 6.1
- TI-2021-14863 XSS in V3 Demo Portlet CVSS 3.1MEDIUM 6.1
- TI-2020-12022 Information disclosure in JUnit4 CVSS 3.1MEDIUM 5.5
Sources
- CVE-2019-0186 · CVE Program
- CVE-2019-0186 · NVD
- FIRST EPSS
- GHSA-w47g-4vrc-m3w2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences