Description
A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.0 or later.
Remediation
References
https://lists.apache.org/thread/r2j00nrnpjgcmoxvlv3pgfoq9kzrcsfh
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2021-40369
http://www.openwall.com/lists/oss-security/2022/08/03/3
Related Vulnerabilities
CVE-2019-1003091 Vulnerability in maven package com.soasta.jenkins:cloudtest
CVE-2018-1000108 Vulnerability in maven package org.jenkins-ci.plugins:cppncss
CVE-2018-12545 Vulnerability in maven package org.eclipse.jetty.http2:http2-common
CVE-2022-44729 Vulnerability in maven package org.apache.xmlgraphics:batik-bridge
CVE-2014-0050 Vulnerability in maven package org.apache.jackrabbit:oak-run