CVE-2024-27136CWE-79

Apache JSPWiki: Cross-site scripting vulnerability on upload page

Medium · published June 24, 2024

Patch now

High probability of exploitation

CVSS calls it medium at 6.1. It sits in the 99.2th percentile for exploit probability.

CVSS v3.1

6.1

EPSS

61%

Percentile

99.2

In the wild

Unconfirmed

What it is

XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.2 or later.

The record

Technical detail

CVSS v3.1: 6.1 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.60846 · 99.2th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2024-06-24T07:44Z

EPSS history

Timeline

24 JUN 07:44Z
Apache JSPWiki: Cross-site scripting vulnerability on upload page
cvelistv5