CVE-2019-10077

Vulnerability

Analysis

CVE-2019-10077 is a cross-site scripting (XSS) vulnerability in Apache JSPWiki affecting versions 2.9.0 through 2.11.0.M3. The root cause lies in insufficient sanitization of InterWiki links, which allow wiki pages to reference external sites using a special syntax. An attacker can craft a malicious InterWiki link containing JavaScript code that, when rendered by the wiki engine, executes in the context of the viewer's browser [1].

Exploitation

The attack surface is the wiki page editing functionality—any user with the ability to create or edit wiki pages can inject the malicious link. The vulnerability does not require authentication beyond standard wiki editing permissions. The crafted link is stored in the page content, meaning the XSS payload triggers whenever any user—including administrators—views the affected page. No social engineering beyond enticing a user to load the compromised page is needed [2].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's session. The most direct consequence is session hijacking: the attacker can steal session cookies or perform actions on behalf of the victim, potentially gaining administrative privileges if the victim is an administrator. This can lead to full wiki compromise, data theft, and further lateral movement within the hosting environment [1].

Mitigation

The Apache Software Foundation released version 2.11.0.M4, which patches the vulnerability by properly escaping InterWiki link output. All users running affected versions are advised to upgrade immediately. No known workarounds exist other than upgrading. This CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of this writing, but it is a publicly documented, easily weaponizable issue [2].