CVE-2019-10078: XSS
Published May 20, 2019
·Updated
A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable.
Affected Software
7 affected components
Apache JSPWiki>=2.9.0<=2.11.0
Apache JSPWiki=2.11.0-m1
Apache JSPWiki=2.11.0-m1-rc1
Apache JSPWiki=2.11.0-m1-rc2
Apache JSPWiki=2.11.0-m1.rc3
Apache JSPWiki=2.11.0-m2
Apache JSPWiki=2.11.0-m2-rc1
Event History
May 20, 2019
CVE Published
via MITRE·08:50 PM
Data Sourced
via MITRE·08:50 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2019-10078?
The severity of CVE-2019-10078 is medium.
2
Which versions of Apache JSPWiki are affected by CVE-2019-10078?
Apache JSPWiki versions 2.9.0 to 2.11.0.M3 are affected by CVE-2019-10078.
3
What is the impact of CVE-2019-10078?
CVE-2019-10078 could lead to session hijacking.
4
Which plugins are vulnerable to CVE-2019-10078?
Multiple plugins on Apache JSPWiki are vulnerable to CVE-2019-10078.
5
How can I fix CVE-2019-10078?
Upgrade Apache JSPWiki to a version later than 2.11.0.M3 to fix CVE-2019-10078.