Cross-site scripting in Apache JSPWiki
Priority LOW 35CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable.
Why it matters now
EPSS 0.04937 92nd percentileScored 2026-11-07
Fix Fixed org.apache.jspwiki:jspwiki-war (Maven): 2.11.0.M4org.apache.jspwiki:jspwiki-main (Maven): 2.11.0.M4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache JSPWiki | Apache JSPWiki 2.9.0 to 2.11.0.M3 | — | No fix listed | CNA |
| — | org.apache.jspwiki:jspwiki-war (Maven) | 2.9.0 to before 2.11.0.M4 | 2.11.0.M4 | Patch available | GHSA-hp5r-mhgp-56c9 |
| — | org.apache.jspwiki:jspwiki-main (Maven) | 2.9.0 to before 2.11.0.M4 | 2.11.0.M4 | Patch available | GHSA-hp5r-mhgp-56c9 |
- Apache JSPWiki VendorApache Affected Apache JSPWiki 2.9.0 to 2.11.0.M3 Fixed in — No fix listed CNA
- org.apache.jspwiki:jspwiki-war (Maven) Vendor— Affected 2.9.0 to before 2.11.0.M4 Fixed in 2.11.0.M4 Patch available GHSA-hp5r-mhgp-56c9
- org.apache.jspwiki:jspwiki-main (Maven) Vendor— Affected 2.9.0 to before 2.11.0.M4 Fixed in 2.11.0.M4 Patch available GHSA-hp5r-mhgp-56c9
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:jspwiki:*:*:*:*:*:*:*:* | 2.9.0 – 2.11.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:jspwiki:2.11.0:m1:*:*:*:*:*:* | 2.11.0 m1 | Vulnerable | Apache |
| cpe:2.3:a:apache:jspwiki:2.11.0:m1-rc1:*:*:*:*:*:* | 2.11.0 m1-rc1 | Vulnerable | Apache |
| cpe:2.3:a:apache:jspwiki:2.11.0:m1-rc2:*:*:*:*:*:* | 2.11.0 m1-rc2 | Vulnerable | Apache |
| cpe:2.3:a:apache:jspwiki:2.11.0:m1.rc3:*:*:*:*:*:* | 2.11.0 m1.rc3 | Vulnerable | Apache |
| cpe:2.3:a:apache:jspwiki:2.11.0:m2:*:*:*:*:*:* | 2.11.0 m2 | Vulnerable | Apache |
| cpe:2.3:a:apache:jspwiki:2.11.0:m2-rc1:*:*:*:*:*:* | 2.11.0 m2-rc1 | Vulnerable | Apache |
- cpe:2.3:a:apache:jspwiki:*:*:*:*:*:*:*:* Versions 2.9.0 – 2.11.0 Vulnerable ·Apache
- cpe:2.3:a:apache:jspwiki:2.11.0:m1:*:*:*:*:*:* Versions 2.11.0 m1 Vulnerable ·Apache
- cpe:2.3:a:apache:jspwiki:2.11.0:m1-rc1:*:*:*:*:*:* Versions 2.11.0 m1-rc1 Vulnerable ·Apache
- cpe:2.3:a:apache:jspwiki:2.11.0:m1-rc2:*:*:*:*:*:* Versions 2.11.0 m1-rc2 Vulnerable ·Apache
- cpe:2.3:a:apache:jspwiki:2.11.0:m1.rc3:*:*:*:*:*:* Versions 2.11.0 m1.rc3 Vulnerable ·Apache
- cpe:2.3:a:apache:jspwiki:2.11.0:m2:*:*:*:*:*:* Versions 2.11.0 m2 Vulnerable ·Apache
- cpe:2.3:a:apache:jspwiki:2.11.0:m2-rc1:*:*:*:*:*:* Versions 2.11.0 m2-rc1 Vulnerable ·Apache
Remediation
- Fix · GHSA-hp5r-mhgp-56c9 org.apache.jspwiki:jspwiki-war (Maven) Fixed in 2.11.0.M4 Advisory →
- Fix · GHSA-hp5r-mhgp-56c9 org.apache.jspwiki:jspwiki-main (Maven) Fixed in 2.11.0.M4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-10078
- 2026-10-03 Alias added: GHSA-hp5r-mhgp-56c9
References
Advisory 2
Other 4
- [jspwiki-dev] 20190519 [CVE-2019-10078] Apache JSPWiki Cross-site scripting vulnerability on Apache JSPWiki
- [jspwiki-commits] 20190519 [jspwiki-site] branch jbake updated: added CVE-2019-10076, CVE-2019-10077 and CVE-2019-10078 vulnerability disclosures
- [oss-security] 20190519 [CVE-2019-10078] Apache JSPWiki Cross-site scripting vulnerability
- [jspwiki-dev] 20190521 Re: [CVE-2019-10078] Apache JSPWiki Cross-site scripting vulnerability on Apache JSPWiki
More Apache Jspwiki vulnerabilities
- TI-2022-11364 Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp CVSS 3.1MEDIUM 6.1
- TI-2022-10292 XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2 CVSS 3.1MEDIUM 6.1
- TI-2022-11366 Apache JSPWiki Cross-site scripting vulnerability on WeblogPlugin CVSS 3.1MEDIUM 6.1
- TI-2022-11365 Apache JSPWiki CSRF in UserPreferences.jsp CVSS 3.1MEDIUM 6.5
- TI-2024-17991 Apache JSPWiki: Cross-site scripting vulnerability on upload page CVSS 3.1MEDIUM 6.1
- TI-2026-23006 Apache JSPWiki: UserManager does not sanity-check user database at startup CVSS 3.1CRITICAL 9.8
Sources
- CVE-2019-10078 · CVE Program
- CVE-2019-10078 · NVD
- FIRST EPSS
- GHSA-hp5r-mhgp-56c9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences