CVE-2019-12407: Cross-site Scripting

September 23, 2019

On Apache JSPWiki, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the remember parameter on some of the JSPs, which could allow the attacker to execute javascript in the victim’s browser and get some sensitive information about the victim.

References

jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-12407
nvd.nist.gov/vuln/detail/CVE-2019-12407

Code Behaviors & Features

Detect and mitigate CVE-2019-12407 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →