Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2024-27136: Apache JSPWiki upload page can run malicious code
CVE-2024-27136 · published 2 years ago
Summary
The upload page in Apache JSPWiki versions up to 2.12.1 lets an attacker place JavaScript that runs in a visitor’s browser, potentially exposing personal data. This can happen when users view or interact with maliciously crafted uploads. Upgrade to Apache JSPWiki 2.12.2 or newer to stop the problem.
What to do
- Update apache org.apache.jspwiki:jspwiki-main to version 2.12.2.
- Update apache jspwiki to version 2.12.2 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | apache | org.apache.jspwiki:jspwiki-main |
< 2.12.2 Fix: upgrade to 2.12.2
|
| – | apache | jspwiki |
< 2.12.2 cpe:2.3:a:apache:jspwiki:*:*:*:*:*:*:*:* |
Original advisory text
Apache JSPWiki: Cross-site scripting vulnerability on upload page
XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.2 or later.
References
- https://github.com/advisories/GHSA-36gf-vpj2-j42w
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27136... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-27136 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2024/06/23/3 URL
- https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2024-27136 Vendor Advisory
- https://lists.apache.org/thread/gfms8gbncqqkj52p861b8fnsypwsl1d5 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published24 Jun 2024
Updated20 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta