oss-security - CVE-2021-36737: Apache Portals: XSS in V3 Demo Portlet

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAAqbB_dr90dmdxrVpG-cznaPrtPEQwtViaYgB2EA43efhRgRiA@mail.gmail.com>
Date: Wed, 5 Jan 2022 18:30:38 -0500
From: Neil Griffin <asfgriff@...che.org>
To: general@...tals.apache.org, pluto-user@...tals.apache.org, 
	announce@...che.org, jetspeed-user@...tals.apache.org, security@...che.org, 
	oss-security@...ts.openwall.com
Subject: CVE-2021-36737: Apache Portals: XSS in V3 Demo Portlet

Severity: low

Description:

The input fields of the Apache Pluto UrlTestPortlet are vulnerable to
Cross-Site Scripting (XSS) attacks.  Users should migrate to version 3.1.1
of the v3-demo-portlet.war artifact

Mitigation:

* Uninstall the v3-demo-portlet.war artifact
   -or-
* Migrate to version 3.1.1 of the v3-demo-portlet.war artifact

Credit:

Thanks to Dhiraj Mishra for reporting.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.