CVE-2019-12404

Vulnerability

Overview

CVE-2019-12404 is a cross-site scripting (XSS) vulnerability in Apache JSPWiki versions up to and including 2.11.0.M4. The flaw resides in the InfoContent.jsp page, where a carefully crafted plugin link invocation is not properly sanitized. This allows an attacker to inject malicious JavaScript code that will be executed in the context of the victim's browser session [1][2].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious plugin link and tricking a victim into clicking it. The attack does not require authentication, but relies on social engineering to lure the victim to the crafted link. Once the victim clicks the link, the injected JavaScript executes within the JSPWiki application's security context [2].

Impact

Successful exploitation enables the attacker to execute arbitrary JavaScript in the victim's browser. This can lead to theft of sensitive information such as session cookies, authentication tokens, or other data accessible through the DOM. The attacker could also perform actions on behalf of the victim within the JSPWiki application, potentially leading to further compromise [1][2].

Mitigation

The Apache JSPWiki project has addressed this vulnerability in version 2.11.0.M5. Users are strongly advised to upgrade to this version or later to mitigate the risk. No workarounds have been provided for earlier versions [2].