CVE-2022-46907

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.0 or later.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache JSPWiki	< Apache JSPWiki up to 2.12.0

References

http://www.openwall.com/lists/oss-security/2023/05/25/1Mailing List, Third Party Advisory
https://lists.apache.org/thread/1m0mkq2nttx8tn94m11mytn4f0tv1504Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2023/05/25/1Mailing List, Third Party Advisory
https://lists.apache.org/thread/1m0mkq2nttx8tn94m11mytn4f0tv1504Mailing List, Vendor Advisory

Timeline

Published: May 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-469087.3SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunction CVE-2022-46915.4Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.CVE-2022-469108.8An issue in the firmware update process of TP-Link TL-WA901ND V1 up to v3.11.2 and TL-WA901N V2 up to v3.12.16 allows attackers to execute a CVE-2022-469128.8An issue in the firmware update process of TP-Link TL-WR841N / TL-WA841ND V7 3.13.9 and earlier allows attackers to execute arbitrary code o CVE-2022-469148.8An issue in the firmware update process of TP-LINK TL-WA801N / TL-WA801ND V1 v3.12.16 and earlier allows attackers to execute arbitrary code CVE-2022-46925.4Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.CVE-2022-46939.8The User Verification WordPress plugin before 1.0.94 was affected by an Auth Bypass security vulnerability. To bypass authentication, we onl CVE-2022-469346.1kkFileView v4.1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewCon CVE-2022-46945.4Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.CVE-2022-469456.5Nagvis before 1.9.34 was discovered to contain an arbitrary file read vulnerability via the component /core/classes/NagVisHoverUrl.php.CVE-2022-469467.2Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete CVE-2022-469477.2Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete