MEDIUM
XSS in V3 Demo Portlet
Published Jan 6, 2022
6.1
MEDIUMCVSS 3.1
EPSS 2.33%
Description
The input fields of the Apache Pluto UrlTestPortlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the v3-demo-portlet.war artifact
Affected products
-
- Version org.apache.portals.pluto.demo:v3-demo-portlet 3.1.0StatusaffectedConstraints-
- Version org.apache.portals.pluto:PortletV3Demo 3.0.0StatusaffectedConstraints-
- Version org.apache.portals.pluto:PortletV3Demo 3.0.1StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Apache Software Foundation | Apache Portals | n/a |
|
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Vendor solution
* Uninstall the v3-demo-portlet.war artifact -or- * Migrate to version 3.1.1 of the v3-demo-portlet.war artifact
Weaknesses (1)
References (3)
- https://github.com/advisories/GHSA-x588-g38j-f672 Advisory
- https://lists.apache.org/thread/x7kt47bf358x8sg9qg02zt0dmdrtow25 x_refsource_MISCMailing ListVendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-36737
| Link | Providers | Tags |
|---|---|---|
| https://github.com/advisories/GHSA-x588-g38j-f672 | Advisory | |
| https://lists.apache.org/thread/x7kt47bf358x8sg9qg02zt0dmdrtow25 | x_refsource_MISCMailing ListVendor Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2021-36737 |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner apache
Published Jan 6, 2022
Updated Aug 4, 2024
Reserved Jul 14, 2021
Link CVE-2021-36737
CISA Vulnrichment
GHSA-X588-G38J-F672 Updated n/a