CVE-2019-10090: XSS
First published: Mon Sep 23 2019(Updated: )
On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the plain editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache JSPWiki | <=2.10.5 | |
| Apache JSPWiki | =2.11.0-m1 | |
| Apache JSPWiki | =2.11.0-m1-rc1 | |
| Apache JSPWiki | =2.11.0-m1-rc2 | |
| Apache JSPWiki | =2.11.0-m1-rc3 | |
| Apache JSPWiki | =2.11.0-m2 | |
| Apache JSPWiki | =2.11.0-m2-rc1 | |
| Apache JSPWiki | =2.11.0-m3 | |
| Apache JSPWiki | =2.11.0-m3-rc1 | |
| Apache JSPWiki | =2.11.0-m3-rc2 | |
| Apache JSPWiki | =2.11.0-m4 | |
| Apache JSPWiki | =2.11.0-m4-rc1 | |
| Apache JSPWiki | =2.11.0-m4-rc2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-10090?
CVE-2019-10090 is a vulnerability on Apache JSPWiki that could allow an attacker to execute JavaScript in the victim's browser and access sensitive information.
How does CVE-2019-10090 work?
CVE-2019-10090 can be triggered by a carefully crafted plugin link invocation, which can lead to an XSS vulnerability in Apache JSPWiki's plain editor.
What is the severity of CVE-2019-10090?
CVE-2019-10090 has a severity level of 6.1 (Medium) according to the Common Vulnerability Scoring System (CVSS).
How can I fix CVE-2019-10090?
To fix CVE-2019-10090, you should upgrade Apache JSPWiki to version 2.11.0.M4 or later.
Where can I find more information about CVE-2019-10090?
You can find more information about CVE-2019-10090 on the Apache JSPWiki website at the following link: https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10090
- collector/nvd-index
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/event
- agent/references
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/apache
- canonical/apache jspwiki
- version/apache jspwiki/2.10.5
- version/apache jspwiki/2.11.0-m1
- version/apache jspwiki/2.11.0-m1-rc1
- version/apache jspwiki/2.11.0-m1-rc2
- version/apache jspwiki/2.11.0-m1-rc3
- version/apache jspwiki/2.11.0-m2
- version/apache jspwiki/2.11.0-m2-rc1
- version/apache jspwiki/2.11.0-m3
- version/apache jspwiki/2.11.0-m3-rc1
- version/apache jspwiki/2.11.0-m3-rc2
- version/apache jspwiki/2.11.0-m4
- version/apache jspwiki/2.11.0-m4-rc1
- version/apache jspwiki/2.11.0-m4-rc2