Miggo Logo
Miggo Vulnerability Database
→
CVE-2018-20242

CVE-2018-20242: Cross-site Scripting in jspwiki-war

6.1

CVSS Score
3.0

Basic Information

CVE ID
CVE-2018-20242
GHSA ID
GHSA-5q75-cxcq-wr26
EPSS Score
0.79537%
CWE
CWE-79
Published
2/12/2019
Updated
1/9/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.apache.jspwiki:jspwiki-warmaven<= 2.10.52.11.0.M1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from unescaped user input in URL parameters being reflected in HTML output. Key areas are request handlers (like WikiServlet) and attachment processors. These functions likely received escaping fixes in the patched version (2.11.0.M1). Confidence is medium due to reliance on XSS patterns in JSPWiki's architecture when direct patch details are unavailable.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* **r**ully *r**t** URL *oul* tri***r *n XSS vuln*r**ility on *p**** JSPWiki, *rom v*rsions up to *.**.*, w*i** *oul* l*** to s*ssion *ij**kin*.

Reasoning

T** vuln*r**ility st*ms *rom un*s**p** us*r input in URL p*r*m*t*rs **in* r**l**t** in *TML output. K*y *r**s *r* r*qu*st **n*l*rs (lik* `WikiS*rvl*t`) *n* *tt***m*nt pro**ssors. T**s* *un*tions lik*ly r***iv** *s**pin* *ix*s in t** p*t**** v*rsion (