JSPWiki Cross-Site Scripting Vulnerability

BID:11746

Info

JSPWiki Cross-Site Scripting Vulnerability

Bugtraq ID: 11746
Class: Input Validation Error
CVE:
Remote: Yes
Local: No
Published: Nov 24 2004 12:00AM
Updated: Nov 24 2004 12:00AM
Credit: Jeremy Bae at STG Security disclosed this vulnerability.
Vulnerable: JSPWiki JSPWiki 2.1.122
JSPWiki JSPWiki 2.1.121
JSPWiki JSPWiki 2.1.120
Not Vulnerable: JSPWiki JSPWiki 2.1.123

Discussion

JSPWiki Cross-Site Scripting Vulnerability

It is reported that JSPWiki is susceptible to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input prior to including it in dynamically generated Web pages.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

This vulnerability is reported to exist in version 2.1.120 of JSPWiki. Other versions may also be affected.

Exploit / POC

JSPWiki Cross-Site Scripting Vulnerability

The following example is available:

http://www.example.com/Search.jsp?query=<script>alert('hi')</script>

Solution / Fix

JSPWiki Cross-Site Scripting Vulnerability

Solution:
The vendor has released version 2.1.123 to address this issue. Please note that this release is directly from the CVS repository from the project, and may not be stable.


JSPWiki JSPWiki 2.1.120

JSPWiki JSPWiki 2.1.121

JSPWiki JSPWiki 2.1.122

References

JSPWiki Cross-Site Scripting Vulnerability

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report