CVE-2022-46907

Published May 25, 2023

Last updated a year ago

CVSS medium 6.1

Overview

Description: A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.0 or later.
Source: security@apache.org
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.1
Impact score: 2.7
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

security@apache.org: CWE-79

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:jspwiki:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "94906882-0669-4248-850D-2338931F0244",
            "versionEndExcluding": "2.12.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References