CVE-2025-24853CWE-79

Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Header Link processing

High · published July 31, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
45.7
In the wild
Unconfirmed
What it is

A carefully crafted request when creating a header link using the

wiki markup syntax, which could allow the attacker to execute javascript

in the victim's browser and get some sensitive information about the

victim.

Further research by the JSPWiki team showed that the markdown parser allowed this kind of attack too.

Apache JSPWiki users should upgrade to 2.12.3 or later.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00557 · 45.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-07-31T08:42Z
EPSS history
Timeline
  • 31 JUL 08:42Z
    Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Header Link processing
    cvelistv5