CVE-2026-48910

A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This issue affects Apache JSPWiki: through 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes the issue.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/yvbdjnocw5qq3xkbjs9h77ghlg0bsw2c	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/07/30/18	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:jspwiki:*:*:*:*:*:*:*:*

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Una solicitud de edición cuidadosamente elaborada podría desencadenar una vulnerabilidad XSS en Apache JSPWiki al analizar errores en el renderizador de markdown, lo que podría permitir al atacante ejecutar javascript en el navegador de la víctima y obtener información sensible sobre la víctima. Este problema afecta a Apache JSPWiki: hasta la versión 2.12.3. Se recomienda a los usuarios actualizar a la versión 2.12.4, que corrige el problema.

Information

Published : 2026-07-30 16:17

Updated : 2026-10-23 22:10

NVD link : CVE-2026-48910

Mitre link : CVE-2026-48910

CVE.ORG link : CVE-2026-48910

JSON object : View

Products Affected

apache

jspwiki

CWE

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

{"id": "CVE-2026-48910", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48910", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-30T16:36:48.479198Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache JSPWiki", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.12.3"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-30T16:17:12.637", "references": [{"url": "https://lists.apache.org/thread/yvbdjnocw5qq3xkbjs9h77ghlg0bsw2c", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/30/18", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-80"}]}], "descriptions": [{"lang": "en", "value": "A carefully crafted editing request could trigger an XSS vulnerability \non Apache JSPWiki when parsing errors on the markdown renderer, which \ncould allow the attacker to execute javascript in the victim's browser \nand get some sensitive information about the victim.\n\n\nThis issue affects Apache JSPWiki: through 2.12.3.\n\nUsers are recommended to upgrade to version 2.12.4, which fixes the issue."}, {"lang": "es", "value": "Una solicitud de edici\u00f3n cuidadosamente elaborada podr\u00eda desencadenar una vulnerabilidad XSS en Apache JSPWiki al analizar errores en el renderizador de markdown, lo que podr\u00eda permitir al atacante ejecutar javascript en el navegador de la v\u00edctima y obtener informaci\u00f3n sensible sobre la v\u00edctima.\n\nEste problema afecta a Apache JSPWiki: hasta la versi\u00f3n 2.12.3.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 2.12.4, que corrige el problema."}], "lastModified": "2026-10-23T22:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:jspwiki:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8891E7DC-16A4-45E0-9683-0E488593FB1F", "versionEndExcluding": "2.12.4"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}