CVE-2021-36738: XSS vulnerability in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet
Neil Griffin <[email protected]> Wed, 5 Jan 2022 18:32:51 -0500
| Newsgroups | gmane.comp.security.oss.general,gmane.comp.apache.commons.general,gmane.comp.jakarta.pluto.user,gmane.comp.apache.maven.announce,gmane.comp.jakarta.jetspeed.user |
|---|---|
| Message-ID | <CAAqbB_eXdFUkYbaAXQ8jxi5n+mEkbOY7Qnv4xWtWtZg6VS_+Pg@mail.gmail.com> |
--000000000000b9eb8205d4de2c81 Content-Type: text/plain; charset="UTF-8" Severity: moderate Description: The input fields in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the applicant-mvcbean-cdi-jsp-portlet.war artifact Mitigation: * Uninstall the applicant-mvcbean-cdi-jsp-portlet.war artifact -or- * Migrate to version 3.1.1 of the applicant-mvcbean-cdi-jsp-portlet.war artifact --000000000000b9eb8205d4de2c81--