A carefully crafted request when creating a header link using the
wiki markup syntax, which could allow the attacker to execute javascript
in the victim's browser and get some sensitive information about the
victim.
Further research by the JSPWiki team showed that the markdown parser allowed this kind of attack too.
Apache JSPWiki users should upgrade to 2.12.3 or later.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2025-24853 | Vendor Advisory |
Configurations
History
04 Aug 2025, 13:13
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2025-24853 - Vendor Advisory | |
| CPE | cpe:2.3:a:apache:jspwiki:*:*:*:*:*:*:*:* | |
| First Time |
Apache
Apache jspwiki |
31 Jul 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
31 Jul 2025, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-07-31 09:15
Updated : 2025-08-04 13:13
NVD link : CVE-2025-24853
Mitre link : CVE-2025-24853
JSON object : View
Products Affected
apache
- jspwiki
CWE
No CWE.