CVE-2022-46907 json
Apache JSPWiki: XSS Injection points in several plugins
published 2023-05-25 3 y ago modified 2026-06-17 4 mo ago also GHSA-qvq8-cw7f-m7m4 , EUVD-2023-1614
- cvss
- 6.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 67%
- public exploits
- 0
- none known
Summary
A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.0 or later.
Patch / fix
- maven org.apache.jspwiki:jspwiki-main 2.12.0
- maven org.apache.jspwiki:jspwiki-war 2.12.0
- Apache Software Foundation Apache JSPWiki Apache JSPWiki up to 2.12.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
1.16% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.jspwiki:jspwiki-main | <2.12.0 |
2.12.0 |
| maven | org.apache.jspwiki:jspwiki-war | <2.12.0 |
2.12.0 |
Affected products
- Apache Software Foundation Apache JSPWiki
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/apache/jspwiki/commit/0b9a0149032170063f22d65e335dfd317db815ea
web
-
github.com
/apache/jspwiki/commit/46e1ef7a595ca5cabf5ef184139910413f2024fc
web
-
github.com
/apache/jspwiki/commit/484c6a133e397693991b7c9a9b62ef3ca48ce707
web
-
github.com
/apache/jspwiki/commit/75019d337f1d0033b1f65428e75f43baeffd99dd
web
-
github.com
/apache/jspwiki/commit/82be08904a6d8bd22fa2d4e5a7e85f43408724d3
web
-
github.com
/apache/jspwiki/commit/9d6dbf911d52d724297e4e46c4b80649fb028ff9
web
-
github.com
/apache/jspwiki/commit/df20770f251a8d7431047e556b144ef24ee6a3a7
web
-
lists.apache.org
/thread/1m0mkq2nttx8tn94m11mytn4f0tv1504
vendor-advisory, web, mailing-list
-
openwall.com
/lists/oss-security/2023/05/25/1
web, mailing-list, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-46907
advisory
-
github.com
/apache/jspwiki
package
-
github.com
/apache/jspwiki/blob/37bf55373ed5a739a388a720163cf51d1104537f/ChangeLog.md?plain=1#L112
web
-
jspwiki-wiki.apache.org
/Wiki.jsp?page=CVE-2022-46907
web
Sources
- CVE List CVE-2022-46907
- GitHub Advisory GHSA-qvq8-cw7f-m7m4
- NVD CVE-2022-46907
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.