Read the docs
TI-2019-07402 Aliases CVE-2019-10077GHSA-cj6j-32rg-45r2

Cross-site scripting in Apache JSPWiki

Priority LOW 35CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.

Why it matters now

EPSS 0.0468 91st percentileScored 2026-11-07
Fix Fixed org.apache.jspwiki:jspwiki-war (Maven): 2.11.0.M4org.apache.jspwiki:jspwiki-main (Maven): 2.11.0.M4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache JSPWikiApache JSPWiki 2.9.0 to 2.11.0.M3—No fix listedCNA
—org.apache.jspwiki:jspwiki-war (Maven)2.9.0 to before 2.11.0.M42.11.0.M4Patch availableGHSA-cj6j-32rg-45r2
—org.apache.jspwiki:jspwiki-main (Maven)2.9.0 to before 2.11.0.M42.11.0.M4Patch availableGHSA-cj6j-32rg-45r2
  • Apache JSPWiki VendorApache Affected Apache JSPWiki 2.9.0 to 2.11.0.M3 Fixed in — No fix listed CNA
  • org.apache.jspwiki:jspwiki-war (Maven) Vendor— Affected 2.9.0 to before 2.11.0.M4 Fixed in 2.11.0.M4 Patch available GHSA-cj6j-32rg-45r2
  • org.apache.jspwiki:jspwiki-main (Maven) Vendor— Affected 2.9.0 to before 2.11.0.M4 Fixed in 2.11.0.M4 Patch available GHSA-cj6j-32rg-45r2

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:apache:jspwiki:*:*:*:*:*:*:*:*2.9.0 – 2.11.0VulnerableApache
cpe:2.3:a:apache:jspwiki:2.11.0:m1:*:*:*:*:*:*2.11.0 m1VulnerableApache
cpe:2.3:a:apache:jspwiki:2.11.0:m1-rc1:*:*:*:*:*:*2.11.0 m1-rc1VulnerableApache
cpe:2.3:a:apache:jspwiki:2.11.0:m1-rc2:*:*:*:*:*:*2.11.0 m1-rc2VulnerableApache
cpe:2.3:a:apache:jspwiki:2.11.0:m1.rc3:*:*:*:*:*:*2.11.0 m1.rc3VulnerableApache
cpe:2.3:a:apache:jspwiki:2.11.0:m2:*:*:*:*:*:*2.11.0 m2VulnerableApache
cpe:2.3:a:apache:jspwiki:2.11.0:m2-rc1:*:*:*:*:*:*2.11.0 m2-rc1VulnerableApache
  • cpe:2.3:a:apache:jspwiki:*:*:*:*:*:*:*:* Versions 2.9.0 – 2.11.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:jspwiki:2.11.0:m1:*:*:*:*:*:* Versions 2.11.0 m1 Vulnerable ·Apache
  • cpe:2.3:a:apache:jspwiki:2.11.0:m1-rc1:*:*:*:*:*:* Versions 2.11.0 m1-rc1 Vulnerable ·Apache
  • cpe:2.3:a:apache:jspwiki:2.11.0:m1-rc2:*:*:*:*:*:* Versions 2.11.0 m1-rc2 Vulnerable ·Apache
  • cpe:2.3:a:apache:jspwiki:2.11.0:m1.rc3:*:*:*:*:*:* Versions 2.11.0 m1.rc3 Vulnerable ·Apache
  • cpe:2.3:a:apache:jspwiki:2.11.0:m2:*:*:*:*:*:* Versions 2.11.0 m2 Vulnerable ·Apache
  • cpe:2.3:a:apache:jspwiki:2.11.0:m2-rc1:*:*:*:*:*:* Versions 2.11.0 m2-rc1 Vulnerable ·Apache

Remediation

  • Fix · GHSA-cj6j-32rg-45r2 org.apache.jspwiki:jspwiki-war (Maven) Fixed in 2.11.0.M4 Advisory →
  • Fix · GHSA-cj6j-32rg-45r2 org.apache.jspwiki:jspwiki-main (Maven) Fixed in 2.11.0.M4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-10077
  2. 2026-10-03 Alias added: GHSA-cj6j-32rg-45r2

References

Advisory 2

Other 2

  • TI-2022-11364 Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp CVSS 3.1MEDIUM 6.1
  • TI-2022-10292 XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2 CVSS 3.1MEDIUM 6.1
  • TI-2022-11366 Apache JSPWiki Cross-site scripting vulnerability on WeblogPlugin CVSS 3.1MEDIUM 6.1
  • TI-2022-11365 Apache JSPWiki CSRF in UserPreferences.jsp CVSS 3.1MEDIUM 6.5
  • TI-2024-17991 Apache JSPWiki: Cross-site scripting vulnerability on upload page CVSS 3.1MEDIUM 6.1
  • TI-2026-23006 Apache JSPWiki: UserManager does not sanity-check user database at startup CVSS 3.1CRITICAL 9.8
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences