Apache JSPWiki vulnerabilities
7 known vulnerabilities in Apache JSPWiki from Apache. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
Apache JSPWiki: Missing Authentication for Critical Functionality
Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables. Users are recommended to upgrade to version 2.12.4 or 3.0.0, which fixes this issue.
- 8.8 High severity
Apache JSPWiki: Cross-Site Request Forgery
Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities. Users are recommended to upgrade to version 2.12.4, which fixes this issue.
- 9.8 Critical severity
Apache JSPWiki: Authentication Bypass by Spoofing
UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges. Users are recommended to upgrade to version 2.12.4 or newer which fixes this issue.
- 7.5 High severity
Apache JSPWiki: Debug Messages Revealing Unnecessary Information
Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes this issue.
- 7.5 High severity
Apache JSPWiki: Improper Neutralization of Input During Web Page Generation
A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Further research by the JSPWiki team showed
- 8.8 High severity
Apache JSPWiki: Cross-Site Request Forgery
A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege escalation of the attacker's account. Further examination of this issue established that it could also b
- 8.8 High severity
Apache JSPWiki: Cross-Site Request Forgery
Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later.