CVE-2019-10078

Vulnerability

Overview

The vulnerability identified as CVE-2019-10078 affects Apache JSPWiki versions 2.9.0 through 2.11.0.M3. It is a cross-site scripting (XSS) flaw that arises when a specially crafted plugin link invocation is processed. While initial reporting indicated only the ReferredPagesPlugin was vulnerable, further analysis revealed that multiple plugins share this weakness [1][2].

Exploitation and

Attack Surface

An attacker can exploit this vulnerability by enticing a user to click a maliciously crafted link that invokes a vulnerable plugin. No authentication is required beyond the user having an active session on the affected JSPWiki instance. The attack surface is broad given the number of plugins involved, and the vector is client-side, relying on user interaction [1][2].

Impact

Successful exploitation allows an attacker to inject arbitrary JavaScript into the context of the victim's browser. This can lead to session hijacking, enabling the attacker to perform actions as the authenticated user, access sensitive data, or deface the wiki content [1][2].

Mitigation

The Apache Software Foundation has released version 2.11.0.M4, which addresses the vulnerability. Users are strongly advised to upgrade to this version or later to mitigate the risk [2]. No workarounds have been documented, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.