HIGH🇵🇱 Wersja polska

CVE-2025-24853

CVSS 7.5v3.1pub. 2025-07-31upd. 2025-11-04

A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Further research by the JSPWiki team showed that the markdown parser allowed this kind of attack too. Apache JSPWiki users should upgrade to 2.12.3 or later.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

  • Apache Jspwiki

    APP
    Apache
    < 2.12.3
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
XSS
CWE
References

Related vulnerabilities

CVE-2026-28812CRITICAL9.8PL ✓same product

Apache JSPWiki: Podszywanie się pod użytkownika przez brak kontroli w UserManager

CVE-2021-44140CRITICAL9.1PL ✓same product

Apache JSPWiki — zdalne usuwanie plików przez spreparowane żądanie HTTP

CVE-2026-28811HIGH7.5PL ✓same product

Apache JSPWiki: ujawnianie informacji przez komunikaty debugowania

CVE-2026-28813HIGH8.8PL ✓same product

Apache JSPWiki – JSON Hijacking prowadzący do podatności CSRF

CVE-2026-28814HIGH7.5PL ✓same product

Apache JSPWiki — nieautoryzowane renderowanie Wiki Markup ujawnia dane