CVE-2018-20242

Vulnerability

A cross-site scripting (XSS) vulnerability exists in Apache JSPWiki versions up to and including 2.10.5 [1][2]. The flaw is triggered by a specially crafted URL, which injects malicious script into the page output [1]. No special configuration is required; the vulnerable code path is reachable when the server processes a crafted request [1][2].

Exploitation

An attacker can exploit this vulnerability by sending a crafted URL to a victim, either directly or via a malicious link. The victim must visit the crafted URL while authenticated (or with an active session) to a JSPWiki instance. No additional privileges or network position beyond standard web access are needed [1]. The script executes in the context of the victim's browser session, allowing theft of session cookies or execution of arbitrary actions on behalf of the victim [1][2].

Impact

Successful exploitation leads to reflected XSS, enabling the attacker to hijack the victim's session. This compromises the confidentiality and integrity of the JSPWiki instance, as the attacker can impersonate the victim, access sensitive data, or perform actions as the victim [1][2]. The scope of compromise is limited to the victim's session within the JSPWiki application.

Mitigation

The vulnerability is fixed in Apache JSPWiki version 2.11.0.M1 [2]. Users should upgrade to this version or later. No workaround is documented. JSPWiki versions prior to 2.10.5 are affected [1][2]. There is no indication this CVE is listed in the Known Exploited Vulnerabilities (KEV) catalog.