Apache JSPWiki: XSS Injection points in several plugins
Priority LOW 30CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.0 or later.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01162 67th percentileScored 2026-11-07
Fix Fixed Apache JSPWiki (Apache Software Foundation): Apache JSPWiki up to 2.12.0org.apache.jspwiki:jspwiki-main (Maven): 2.12.0+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache JSPWiki | before Apache JSPWiki up to 2.12.0 | Apache JSPWiki up to 2.12.0 | Patch available | CNA |
| — | org.apache.jspwiki:jspwiki-main (Maven) | before 2.12.0 | 2.12.0 | Patch available | GHSA-qvq8-cw7f-m7m4 |
| — | org.apache.jspwiki:jspwiki-war (Maven) | before 2.12.0 | 2.12.0 | Patch available | GHSA-qvq8-cw7f-m7m4 |
- Apache JSPWiki VendorApache Affected before Apache JSPWiki up to 2.12.0 Fixed in Apache JSPWiki up to 2.12.0 Patch available CNA
- org.apache.jspwiki:jspwiki-main (Maven) Vendor— Affected before 2.12.0 Fixed in 2.12.0 Patch available GHSA-qvq8-cw7f-m7m4
- org.apache.jspwiki:jspwiki-war (Maven) Vendor— Affected before 2.12.0 Fixed in 2.12.0 Patch available GHSA-qvq8-cw7f-m7m4
Remediation
- Fix · CNA Apache JSPWiki (Apache Software Foundation) Fixed in Apache JSPWiki up to 2.12.0
- Fix · GHSA-qvq8-cw7f-m7m4 org.apache.jspwiki:jspwiki-main (Maven) Fixed in 2.12.0 Advisory →
- Fix · GHSA-qvq8-cw7f-m7m4 org.apache.jspwiki:jspwiki-war (Maven) Fixed in 2.12.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-46907
- 2026-10-03 Alias added: GHSA-qvq8-cw7f-m7m4
References
Advisory 3
Other 10
- https://github.com/apache/jspwiki/commit/0b9a0149032170063f22d65e335dfd317db815ea
- https://github.com/apache/jspwiki/commit/46e1ef7a595ca5cabf5ef184139910413f2024fc
- https://github.com/apache/jspwiki/commit/484c6a133e397693991b7c9a9b62ef3ca48ce707
- https://github.com/apache/jspwiki/commit/75019d337f1d0033b1f65428e75f43baeffd99dd
- https://github.com/apache/jspwiki/commit/82be08904a6d8bd22fa2d4e5a7e85f43408724d3
- https://github.com/apache/jspwiki/commit/9d6dbf911d52d724297e4e46c4b80649fb028ff9
- https://github.com/apache/jspwiki/commit/df20770f251a8d7431047e556b144ef24ee6a3a7
- https://github.com/apache/jspwiki
- https://github.com/apache/jspwiki/blob/37bf55373ed5a739a388a720163cf51d1104537f/ChangeLog.md?plain=1#L112
- https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-46907
More Apache Jspwiki vulnerabilities
- TI-2022-11364 Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp CVSS 3.1MEDIUM 6.1
- TI-2022-10292 XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2 CVSS 3.1MEDIUM 6.1
- TI-2022-11366 Apache JSPWiki Cross-site scripting vulnerability on WeblogPlugin CVSS 3.1MEDIUM 6.1
- TI-2022-11365 Apache JSPWiki CSRF in UserPreferences.jsp CVSS 3.1MEDIUM 6.5
- TI-2024-17991 Apache JSPWiki: Cross-site scripting vulnerability on upload page CVSS 3.1MEDIUM 6.1
- TI-2026-23006 Apache JSPWiki: UserManager does not sanity-check user database at startup CVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-46907 · CVE Program
- CVE-2022-46907 · NVD
- FIRST EPSS
- GHSA-qvq8-cw7f-m7m4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences