You are viewing a plain text version of this content. The canonical link for it is here.
Posted to announce@apache.org by Juan Pablo Santos RodrÃguez <ju...@apache.org> on 2019/03/26 21:36:06 UTC
[CVE-2019-0225] Apache JSPWiki Local File Inclusion (limited ROOT
folder) vulnerability leads to user information disclosure
Severity: High
Vendor: The Apache Software Foundation
Versions Affected: Apache JSPWiki up to 2.11.0.M2
Description:
A specially crafted url could be used to access files under the ROOT
directory of the application on Apache JSPWiki, which could be used by an
attacker to obtain registered users' details.
Mitigation:
Apache JSPWiki users should upgrade to 2.11.0.M3 or later.
Credit:
This issue was discovered by Muthukumar Marikani (
https://twitter.com/unkn0wn_p3rson), from ZOHO-CRM Security Team