CVE-2019-10089
Last modified
CVE-2019-10089 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the WYSIWYG editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.. EPSS estimates a 2.90% chance of exploitation in the next 30 days.
Description
On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the WYSIWYG editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Apache | Jspwiki | <= 2.10.5 | — |
| Apache | Jspwiki | 2.11.0 | M1 |
References
- https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10089Vendor Advisory
- https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10089Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-10089?
How severe is CVE-2019-10089?
How do I fix CVE-2019-10089?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-10083When updating a Process Group via the API in NiFi versions 1…5.3
- CVE-2019-10084In Apache Impala 2.7.0 to 3.2.0, an authenticated user with …7.5
- CVE-2019-10085In Apache Allura prior to 1.11.0, a vulnerability exists for…
- CVE-2019-10086In Apache Commons Beanutils 1.9.2, a special BeanIntrospecto…7.3
- CVE-2019-10087On Apache JSPWiki, up to version 2.11.0.M4, a carefully craf…6.1
- CVE-2019-10088A carefully crafted or corrupt zip file can cause an OOM in …
- CVE-2019-1009An information disclosure vulnerability exists when the Wind…4.7
- CVE-2019-10090On Apache JSPWiki, up to version 2.11.0.M4, a carefully craf…6.1
- CVE-2019-10091When TLS is enabled with ssl-endpoint-identification-enabled…7.4
- CVE-2019-10092In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scr…6.1
- CVE-2019-10093In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2…
- CVE-2019-10094A carefully crafted package/compressed file that, when unzip…
Are you affected by CVE-2019-10089?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST