Apache JSPWiki Cross-site scripting vulnerability on User Preferences screen

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in the user preferences screen of Apache JSPWiki versions up to 2.11.1 [1][2]. The flaw is triggered by a carefully crafted user preferences submission, which allows an attacker to inject malicious JavaScript code that executes in the context of the victim's browser session [2].

Exploitation

The attacker needs to be able to submit crafted user preferences to the server. This could be achieved by tricking an authenticated user (e.g., an admin) to visit a malicious link or by exploiting other mechanisms to submit the payload. Once the victim views the injected content on the user preferences screen, the attacker-supplied JavaScript executes in the victim's browser [2].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser on the affected Apache JSPWiki instance. This can lead to theft of sensitive information, such as session cookies or authentication tokens, which could be used to impersonate the victim or access other protected resources [1][2].

Mitigation

Users should upgrade to Apache JSPWiki version 2.11.2 or later, which contains the fix for this vulnerability [1][2]. No workarounds are mentioned in the available references.