GHSA-w47g-4vrc-m3w2

    Dashboard / Vulnerabilities / GHSA-w47g-4vrc-m3w2

    GHSA-w47g-4vrc-m3w2

    Published: 24 May 2022Last Modified: 18 Feb 2024
    Aliases:
    CVE-2019-0186

    Summary: Cross-site Scripting in Apache Pluto Chatroom demo

    Details: The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks. Mitigation: * Uninstall the ChatRoomDemo war file - or - * migrate to version 3.1.0 of the chat-room-demo war file

    References: https://nvd.nist.gov/vuln/detail/CVE-2019-0186, https://lists.apache.org/thread.html/d093e6b0e5f9b3b50928255451afefd8f8fbdcd5bf28a726769a919a@%3Cpluto-user.portals.apache.org%3E, https://portals.apache.org/pluto/security.html, https://www.exploit-db.com/exploits/46759, https://www.openwall.com/lists/oss-security/2019/04/25/8, http://mail-archives.apache.org/mod_mbox/portals-pluto-user/201904.mbox/%3CCAAqbB_ev=0KNgZmmNAq2=q11i1GYLGN6J-xCKx8Q8dbxZ4tZYg@mail.gmail.com%3E

    Affected packages

    Package

    Name: org.apache.portals.pluto:chatRoomDemo

    Purl: pkg:maven/org.apache.portals.pluto/chatRoomDemo

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 3.0.0
    Fixed -3.1.0

    Affected versions

    3.0.0
    3.0.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High