Django REST framework

Lookup for vulnerable packages by Package URL.

Purl pkg:maven/org.apache.jspwiki/jspwiki-war@2.9.0

Type maven

Namespace org.apache.jspwiki

Name jspwiki-war

Version 2.9.0

Qualifiers

Subpath

Is_vulnerable true

Next_non_vulnerable_version 2.11.0.M1

Latest_non_vulnerable_version 2.12.0

Affected_by_vulnerabilities

url VCID-7ckf-bdvx-qkh9

vulnerability_id VCID-7ckf-bdvx-qkh9

summary

Cross-site Scripting
A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki which could lead to session hijacking. Initial reporting indicated `ReferredPagesPlugin`, but further analysis showed that multiple plugins were vulnerable.

references

reference_url	https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10078
reference_id
reference_type
scores
url	https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10078

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2019-10078
reference_id	CVE-2019-10078
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2019-10078

reference_url	https://github.com/advisories/GHSA-hp5r-mhgp-56c9
reference_id	GHSA-hp5r-mhgp-56c9
reference_type
scores
url	https://github.com/advisories/GHSA-hp5r-mhgp-56c9

fixed_packages

url	pkg:maven/org.apache.jspwiki/jspwiki-war@2.11.0.M4
purl	pkg:maven/org.apache.jspwiki/jspwiki-war@2.11.0.M4
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.jspwiki/jspwiki-war@2.11.0.M4

aliases CVE-2019-10078, GHSA-hp5r-mhgp-56c9

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-7ckf-bdvx-qkh9

url VCID-qgwr-kdx8-83f3

vulnerability_id VCID-qgwr-kdx8-83f3

summary

Path Traversal
A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki which could be used by an attacker to obtain registered users' details.

references

reference_url	https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-0225
reference_id
reference_type
scores
url	https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-0225

reference_url	http://www.securityfocus.com/bid/107627
reference_id
reference_type
scores
url	http://www.securityfocus.com/bid/107627

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2019-0225
reference_id	CVE-2019-0225
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2019-0225

fixed_packages

url pkg:maven/org.apache.jspwiki/jspwiki-war@2.11.0.M3

purl pkg:maven/org.apache.jspwiki/jspwiki-war@2.11.0.M3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ckf-bdvx-qkh9

vulnerability	VCID-s4g3-2p5v-v3dn

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.jspwiki/jspwiki-war@2.11.0.M3

aliases CVE-2019-0225

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-qgwr-kdx8-83f3

url VCID-r8n2-f2bj-fud3

vulnerability_id VCID-r8n2-f2bj-fud3

summary

Cross-site Scripting
A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki, which could lead to session hijacking.

references

reference_url	https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10076
reference_id
reference_type
scores
url	https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10076

reference_url	https://lists.apache.org/thread.html/aac253cfc33c0429b528e2fcbe82d3a42d742083c528f58d192dfd16@%3Ccommits.jspwiki.apache.org%3E
reference_id
reference_type
scores
url	https://lists.apache.org/thread.html/aac253cfc33c0429b528e2fcbe82d3a42d742083c528f58d192dfd16@%3Ccommits.jspwiki.apache.org%3E

reference_url	http://www.openwall.com/lists/oss-security/2019/05/19/4
reference_id
reference_type
scores
url	http://www.openwall.com/lists/oss-security/2019/05/19/4

reference_url	http://www.securityfocus.com/bid/108437
reference_id
reference_type
scores
url	http://www.securityfocus.com/bid/108437

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2019-10076
reference_id	CVE-2019-10076
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2019-10076

reference_url	https://github.com/advisories/GHSA-cxx2-fp39-rf3r
reference_id	GHSA-cxx2-fp39-rf3r
reference_type
scores
url	https://github.com/advisories/GHSA-cxx2-fp39-rf3r

fixed_packages

aliases CVE-2019-10076, GHSA-cxx2-fp39-rf3r

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-r8n2-f2bj-fud3

url VCID-s4g3-2p5v-v3dn

vulnerability_id VCID-s4g3-2p5v-v3dn

summary

Cross-site Scripting
A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki, which could lead to session hijacking.

references

reference_url	https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10077
reference_id
reference_type
scores
url	https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10077

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2019-10077
reference_id	CVE-2019-10077
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2019-10077

reference_url	https://github.com/advisories/GHSA-cj6j-32rg-45r2
reference_id	GHSA-cj6j-32rg-45r2
reference_type
scores
url	https://github.com/advisories/GHSA-cj6j-32rg-45r2

fixed_packages

url	pkg:maven/org.apache.jspwiki/jspwiki-war@2.11.0.M4
purl	pkg:maven/org.apache.jspwiki/jspwiki-war@2.11.0.M4
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.jspwiki/jspwiki-war@2.11.0.M4

aliases CVE-2019-10077, GHSA-cj6j-32rg-45r2

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-s4g3-2p5v-v3dn

url VCID-v4jt-qkhw-pqbg

vulnerability_id VCID-v4jt-qkhw-pqbg

summary

Cross-site Scripting
In Apache JSPWiki, a carefully crafted URL could execute javascript on another user's session. No information could be saved on the server or jspwiki database, nor would an attacker be able to execute js on someone else's browser; only on its own browser.

references

reference_url	https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-0224
reference_id
reference_type
scores
url	https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-0224

reference_url	https://lists.apache.org/thread.html/aac253cfc33c0429b528e2fcbe82d3a42d742083c528f58d192dfd16@%3Ccommits.jspwiki.apache.org%3E
reference_id
reference_type
scores
url	https://lists.apache.org/thread.html/aac253cfc33c0429b528e2fcbe82d3a42d742083c528f58d192dfd16@%3Ccommits.jspwiki.apache.org%3E

reference_url	https://lists.apache.org/thread.html/b4b4992a93d899050c1117a07c3c7fc9a175ec0672ab97065228de67@%3Cdev.jspwiki.apache.org%3E
reference_id
reference_type
scores
url	https://lists.apache.org/thread.html/b4b4992a93d899050c1117a07c3c7fc9a175ec0672ab97065228de67@%3Cdev.jspwiki.apache.org%3E

reference_url	https://lists.apache.org/thread.html/e42d6e93384d4a33e939989cd00ea2a06ccf1e7bb1e6bdd3bf5187c1@%3Ccommits.jspwiki.apache.org%3E
reference_id
reference_type
scores
url	https://lists.apache.org/thread.html/e42d6e93384d4a33e939989cd00ea2a06ccf1e7bb1e6bdd3bf5187c1@%3Ccommits.jspwiki.apache.org%3E

reference_url	http://www.securityfocus.com/bid/107631
reference_id
reference_type
scores
url	http://www.securityfocus.com/bid/107631

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2019-0224
reference_id	CVE-2019-0224
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2019-0224

reference_url	https://github.com/advisories/GHSA-fmpq-w5q6-9vf9
reference_id	GHSA-fmpq-w5q6-9vf9
reference_type
scores
url	https://github.com/advisories/GHSA-fmpq-w5q6-9vf9

fixed_packages

url pkg:maven/org.apache.jspwiki/jspwiki-war@2.11.0.M3

purl pkg:maven/org.apache.jspwiki/jspwiki-war@2.11.0.M3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ckf-bdvx-qkh9

vulnerability	VCID-s4g3-2p5v-v3dn

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.jspwiki/jspwiki-war@2.11.0.M3

aliases CVE-2019-0224, GHSA-fmpq-w5q6-9vf9

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-v4jt-qkhw-pqbg

Fixing_vulnerabilities

Risk_score null

Resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.jspwiki/jspwiki-war@2.9.0

Package Instance