CVE-2021-36737: Apache Portals: XSS in V3 Demo Portlet

Neil Griffin <[email protected]> Wed, 5 Jan 2022 18:30:38 -0500

Newsgroups	gmane.comp.security.oss.general,gmane.comp.apache.webservices.general,gmane.comp.jakarta.pluto.user,gmane.comp.apache.maven.announce,gmane.comp.jakarta.jetspeed.user
Message-ID	<CAAqbB_dr90dmdxrVpG-cznaPrtPEQwtViaYgB2EA43efhRgRiA@mail.gmail.com>

--000000000000d8550205d4de24fa
Content-Type: text/plain; charset="UTF-8"

Severity: low

Description:

The input fields of the Apache Pluto UrlTestPortlet are vulnerable to
Cross-Site Scripting (XSS) attacks.  Users should migrate to version 3.1.1
of the v3-demo-portlet.war artifact

Mitigation:

* Uninstall the v3-demo-portlet.war artifact
   -or-
* Migrate to version 3.1.1 of the v3-demo-portlet.war artifact

Credit:

Thanks to Dhiraj Mishra for reporting.

--000000000000d8550205d4de24fa--