XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.2 or later.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2024/06/23/3 | |
| https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2024-27136 | Vendor Advisory |
| https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2024-27136 | Vendor Advisory |
| https://lists.apache.org/thread/gfms8gbncqqkj52p861b8fnsypwsl1d5 | Vendor Advisory |
| https://lists.apache.org/thread/gfms8gbncqqkj52p861b8fnsypwsl1d5 | Vendor Advisory |
Configurations
History
20 Mar 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| CWE |
17 Oct 2024, 13:47
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:apache:jspwiki:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| First Time |
Apache
Apache jspwiki |
|
| References | () https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2024-27136 - Vendor Advisory | |
| References | () https://lists.apache.org/thread/gfms8gbncqqkj52p861b8fnsypwsl1d5 - Vendor Advisory |
24 Jun 2024, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-06-24 08:15
Updated : 2025-03-20 18:15
NVD link : CVE-2024-27136
Mitre link : CVE-2024-27136
JSON object : View
Products Affected
apache
- jspwiki
CWE
No CWE.