Vulnerability Details : CVE-2019-0224
In Apache JSPWiki 2.9.0 to 2.11.0.M2, a carefully crafted URL could execute javascript on another user's session. No information could be saved on the server or jspwiki database, nor would an attacker be able to execute js on someone else's browser; only on its own browser.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2019-0224
- cpe:2.3:a:apache:jspwiki:*:*:*:*:*:*:*:*
- cpe:2.3:a:apache:jspwiki:2.11.0:milestone1-rc1:*:*:*:*:*:*
- cpe:2.3:a:apache:jspwiki:2.11.0:milestone2:*:*:*:*:*:*
- cpe:2.3:a:apache:jspwiki:2.11.0:milestone1-rc2:*:*:*:*:*:*
- cpe:2.3:a:apache:jspwiki:2.11.0:milestone1-rc3:*:*:*:*:*:*
- cpe:2.3:a:apache:jspwiki:2.11.0:milestone1:*:*:*:*:*:*
- cpe:2.3:a:apache:jspwiki:2.11.0:milestone2-rc1:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-0224
3.02%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 85 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-0224
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST | |
|
6.1
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
2.8
|
2.7
|
NIST |
CWE ids for CVE-2019-0224
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-0224
-
https://lists.apache.org/thread.html/aac253cfc33c0429b528e2fcbe82d3a42d742083c528f58d192dfd16@%3Ccommits.jspwiki.apache.org%3E
[jspwiki-site] branch jbake updated: added CVE-2019-10076, CVE-2019-10077 and CVE-2019-10078 vulnerability disclosures - Pony Mail
-
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-0224
JSPWiki: CVE-2019-0224Vendor Advisory
-
https://lists.apache.org/thread.html/b4b4992a93d899050c1117a07c3c7fc9a175ec0672ab97065228de67@%3Cdev.jspwiki.apache.org%3E
[CVE-2019-0224] Apache JSPWiki Cross-site scripting vulnerability - Pony MailMailing List;Vendor Advisory
-
https://lists.apache.org/thread.html/e42d6e93384d4a33e939989cd00ea2a06ccf1e7bb1e6bdd3bf5187c1@%3Ccommits.jspwiki.apache.org%3E
[jspwiki-site] branch jbake updated: add CVE-2019-0224 and CVE-2019-0225 vulnerability disclosures - Pony MailMailing List;Patch;Vendor Advisory
-
http://www.securityfocus.com/bid/107631
Apache JSPWiki CVE-2019-0224 Cross Site Scripting VulnerabilityThird Party Advisory;VDB Entry
Jump to