CVE-2021-33192 - Display information UI XSS

Back Back to CVE browser

MEDIUM

Display information UI XSS

Published Jul 5, 2021

6.1

MEDIUM

CVSS 3.1

EPSS 2.88%

Description

A vulnerability in the HTML pages of Apache Jena Fuseki allows an attacker to execute arbitrary javascript on certain page views. This issue affects Apache Jena Fuseki from version 2.0.0 to version 4.0.0 (inclusive).

Affected products

Vendor Apache Software Foundation Product Apache Jena Fuseki Default
n/a
- Version
  Apache Jena Fuseki2 2.0.0 to 4.0.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Apache Software Foundation

Apache Jena Fuseki

n/a

Version	Status	Constraints
Apache Jena Fuseki2 2.0.0 to 4.0.0	affected	-

Remediation

Vendor solution

Users are advised to upgrade to Apache Jena 4.1.0 or later.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-1819
Advisory
https://github.com/advisories/GHSA-phwj-86vx-cfjc
Advisory
https://lists.apache.org/thread.html/r684d8943d755a96fe90f8cd8df196737b6bde3f2b74e15a9bd479975%40%3Cusers.jena.apache.org%3E
x_refsource_MISCMailing ListVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-33192

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-1819		Advisory
https://github.com/advisories/GHSA-phwj-86vx-cfjc		Advisory
https://lists.apache.org/thread.html/r684d8943d755a96fe90f8cd8df196737b6bde3f2b74e15a9bd479975%40%3Cusers.jena.apache.org%3E		x_refsource_MISCMailing ListVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-33192