CVE-2021-40369

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.0 or later.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache JSPWiki	>= Apache JSPWiki, <= 2.11.0.M8

References

http://www.openwall.com/lists/oss-security/2022/08/03/3Mailing List, Third Party Advisory
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2021-40369Vendor Advisory
https://lists.apache.org/thread/r2j00nrnpjgcmoxvlv3pgfoq9kzrcsfhVendor Advisory
http://www.openwall.com/lists/oss-security/2022/08/03/3Mailing List, Third Party Advisory
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2021-40369Vendor Advisory
https://lists.apache.org/thread/r2j00nrnpjgcmoxvlv3pgfoq9kzrcsfhVendor Advisory

Timeline

Published: Nov 24, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-40374.4A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files fo CVE-2021-403719.8Gridpro Request Management for Windows Azure Pack before 2.0.7912 allows Directory Traversal for remote code execution, as demonstrated by .CVE-2021-403739.8playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the #tabs-information-page of core_main_config, and then execut CVE-2021-403745.4A stored cross-site scripting (XSS) vulnerability was identified in Apperta Foundation OpenEyes 3.5.1. Updating a patient's details allows r CVE-2021-403756.5Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having the intended level of CVE-2021-403767.8otris Update Manager 1.2.1.0 allows local users to achieve SYSTEM access via unauthenticated calls to exposed interfaces over a .NET named p CVE-2021-403775.4SmarterTools SmarterMail 16.x before build 7866 has stored XSS. The application fails to sanitize email content, thus allowing one to inject CVE-2021-403788.1An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. /cgi-bin/support/killps.cgi deletes all da CVE-2021-403797.5An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. rstp://.../medias2 does not require author CVE-2021-40384.8Cross Site Scripting (XSS) vulnerability in McAfee Network Security Manager (NSM) prior to 10.1 Minor 7 allows a remote authenticated admini CVE-2021-403807.5An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. cameralist.cgi and setcamera.cgi disclose CVE-2021-403817.5An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. index_MJpeg.cgi allows video access.