Cross-site scripting in Apache JSPWiki
Priority LOW 35CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
Why it matters now
EPSS 0.04725 91st percentileScored 2026-11-07
Fix Fixed org.apache.jspwiki:jspwiki-war (Maven): 2.11.0.M4org.apache.jspwiki:jspwiki-main (Maven): 2.11.0.M4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache JSPWiki | Apache JSPWiki 2.9.0 to 2.11.0.M3 | — | No fix listed | CNA |
| — | org.apache.jspwiki:jspwiki-war (Maven) | 2.9.0 to before 2.11.0.M4 | 2.11.0.M4 | Patch available | GHSA-cxx2-fp39-rf3r |
| — | org.apache.jspwiki:jspwiki-main (Maven) | 2.9.0 to before 2.11.0.M4 | 2.11.0.M4 | Patch available | GHSA-cxx2-fp39-rf3r |
- Apache JSPWiki VendorApache Affected Apache JSPWiki 2.9.0 to 2.11.0.M3 Fixed in — No fix listed CNA
- org.apache.jspwiki:jspwiki-war (Maven) Vendor— Affected 2.9.0 to before 2.11.0.M4 Fixed in 2.11.0.M4 Patch available GHSA-cxx2-fp39-rf3r
- org.apache.jspwiki:jspwiki-main (Maven) Vendor— Affected 2.9.0 to before 2.11.0.M4 Fixed in 2.11.0.M4 Patch available GHSA-cxx2-fp39-rf3r
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:jspwiki:*:*:*:*:*:*:*:* | 2.9.0 – 2.11.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:jspwiki:2.11.0:m1:*:*:*:*:*:* | 2.11.0 m1 | Vulnerable | Apache |
| cpe:2.3:a:apache:jspwiki:2.11.0:m1-rc1:*:*:*:*:*:* | 2.11.0 m1-rc1 | Vulnerable | Apache |
| cpe:2.3:a:apache:jspwiki:2.11.0:m1-rc2:*:*:*:*:*:* | 2.11.0 m1-rc2 | Vulnerable | Apache |
| cpe:2.3:a:apache:jspwiki:2.11.0:m1.rc3:*:*:*:*:*:* | 2.11.0 m1.rc3 | Vulnerable | Apache |
| cpe:2.3:a:apache:jspwiki:2.11.0:m2:*:*:*:*:*:* | 2.11.0 m2 | Vulnerable | Apache |
| cpe:2.3:a:apache:jspwiki:2.11.0:m2-rc1:*:*:*:*:*:* | 2.11.0 m2-rc1 | Vulnerable | Apache |
- cpe:2.3:a:apache:jspwiki:*:*:*:*:*:*:*:* Versions 2.9.0 – 2.11.0 Vulnerable ·Apache
- cpe:2.3:a:apache:jspwiki:2.11.0:m1:*:*:*:*:*:* Versions 2.11.0 m1 Vulnerable ·Apache
- cpe:2.3:a:apache:jspwiki:2.11.0:m1-rc1:*:*:*:*:*:* Versions 2.11.0 m1-rc1 Vulnerable ·Apache
- cpe:2.3:a:apache:jspwiki:2.11.0:m1-rc2:*:*:*:*:*:* Versions 2.11.0 m1-rc2 Vulnerable ·Apache
- cpe:2.3:a:apache:jspwiki:2.11.0:m1.rc3:*:*:*:*:*:* Versions 2.11.0 m1.rc3 Vulnerable ·Apache
- cpe:2.3:a:apache:jspwiki:2.11.0:m2:*:*:*:*:*:* Versions 2.11.0 m2 Vulnerable ·Apache
- cpe:2.3:a:apache:jspwiki:2.11.0:m2-rc1:*:*:*:*:*:* Versions 2.11.0 m2-rc1 Vulnerable ·Apache
Remediation
- Fix · GHSA-cxx2-fp39-rf3r org.apache.jspwiki:jspwiki-war (Maven) Fixed in 2.11.0.M4 Advisory →
- Fix · GHSA-cxx2-fp39-rf3r org.apache.jspwiki:jspwiki-main (Maven) Fixed in 2.11.0.M4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-10076
- 2026-10-03 Alias added: GHSA-cxx2-fp39-rf3r
References
Advisory 2
Other 3
- [jspwiki-commits] 20190519 [jspwiki-site] branch jbake updated: added CVE-2019-10076, CVE-2019-10077 and CVE-2019-10078 vulnerability disclosures
- [oss-security] 20190519 [CVE-2019-10076] Apache JSPWiki Cross-site scripting vulnerability
- https://lists.apache.org/thread.html/aac253cfc33c0429b528e2fcbe82d3a42d742083c528f58d192dfd16@%3Ccommits.jspwiki.apache.org%3E
More Apache Jspwiki vulnerabilities
- TI-2022-11364 Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp CVSS 3.1MEDIUM 6.1
- TI-2022-10292 XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2 CVSS 3.1MEDIUM 6.1
- TI-2022-11366 Apache JSPWiki Cross-site scripting vulnerability on WeblogPlugin CVSS 3.1MEDIUM 6.1
- TI-2022-11365 Apache JSPWiki CSRF in UserPreferences.jsp CVSS 3.1MEDIUM 6.5
- TI-2024-17991 Apache JSPWiki: Cross-site scripting vulnerability on upload page CVSS 3.1MEDIUM 6.1
- TI-2026-23006 Apache JSPWiki: UserManager does not sanity-check user database at startup CVSS 3.1CRITICAL 9.8
Sources
- CVE-2019-10076 · CVE Program
- CVE-2019-10076 · NVD
- FIRST EPSS
- GHSA-cxx2-fp39-rf3r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences