Vulnerability Description
A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki, related to the user preferences screen, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.2 or later.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Jspwiki | < 2.11.2 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2022/02/25/2Mailing ListThird Party Advisory
- https://lists.apache.org/thread/86p0yzopc4mw2h5bkwpt927b2c8tfq3bMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2022/02/25/2Mailing ListThird Party Advisory
- https://lists.apache.org/thread/86p0yzopc4mw2h5bkwpt927b2c8tfq3bMailing ListVendor Advisory
FAQ
What is CVE-2022-24948?
CVE-2022-24948 is a vulnerability with a CVSS score of 6.1 (MEDIUM). A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki, related to the user preferences screen, which could allow the attacker to execute javascript i...
How severe is CVE-2022-24948?
CVE-2022-24948 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-24948?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Jspwiki.