CVE-2021-36738 - XSS vulnerability in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet

Back Back to CVE browser

MEDIUM

XSS vulnerability in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet

Published Jan 6, 2022

6.1

MEDIUM

CVSS 3.1

EPSS 2.33%

Description

The input fields in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the applicant-mvcbean-cdi-jsp-portlet.war artifact

Affected products

Vendor Apache Software Foundation Product Apache Portals Default
n/a
- Version
  org.apache.portals.pluto.demo:applicant-mvcbean-cdi-jsp-portlet 3.1.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Apache Software Foundation

Apache Portals

n/a

Version	Status	Constraints
org.apache.portals.pluto.demo:applicant-mvcbean-cdi-jsp-portlet 3.1.0	affected	-

Remediation

Vendor solution

* Uninstall the applicant-mvcbean-cdi-jsp-portlet.war artifact -or- * Migrate to version 3.1.1 of the applicant-mvcbean-cdi-jsp-portlet.war artifact

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-0627
Advisory
https://github.com/advisories/GHSA-jg6j-jrxv-2hh9
Advisory
https://lists.apache.org/thread/11j19v1gjsk7o6o8nch1xrydow9b8lll
x_refsource_MISCVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-36738

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-0627		Advisory
https://github.com/advisories/GHSA-jg6j-jrxv-2hh9		Advisory
https://lists.apache.org/thread/11j19v1gjsk7o6o8nch1xrydow9b8lll		x_refsource_MISCVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-36738