Cross-site Scripting Vulnerability in Apache Jetspeed by Apache
CVE-2016-0712

6.1MEDIUM

Key Information:

Vendor

Apache
Status
Jetspeed
Vendor
CVE Published:
11 April 2016

What is CVE-2016-0712?

A Cross-site scripting (XSS) vulnerability exists in Apache Jetspeed prior to version 2.3.1. This flaw allows remote attackers to inject arbitrary web scripts or HTML via the PATH_INFO variable to the portal. Such exploitation could lead to unauthorized actions being performed on behalf of the user or exposure of sensitive information, severely compromising web application security.

References

https://portals.apache.org/jetspeed-2/security-reports.ht...
x_refsource_CONFIRM
https://mail-archives.apache.org/mod_mbox/portals-jetspee...
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.