What is GHSA-h975-r69h-4w9p?

GHSA-h975-r69h-4w9p is a security advisory published by GitHub Security Advisories with Critical severity. Insufficient user input in Apache Jetspeed-2

Which CVE IDs does GHSA-h975-r69h-4w9p cover?

GHSA-h975-r69h-4w9p covers the following CVE IDs: CVE-2022-32533. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-h975-r69h-4w9p?

GHSA-h975-r69h-4w9p has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-h975-r69h-4w9p?

GHSA-h975-r69h-4w9p affects 1 product, including: maven/org.apache.portals.jetspeed-2:jetspeed-commons:\u003c= 2.3.1.

GHSA-h975-r69h-4w9pCriticalCVSS 9.8

Insufficient user input in Apache Jetspeed-2

Vendor

GitHub Security Advisories

Published

July 7, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-32533 →

📋 Description

** UNSUPPORTED WHEN ASSIGNED ** Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant project of Apache Portals and no updates will be provided for this issue.

🎯 Affected products1

maven/org.apache.portals.jetspeed-2:jetspeed-commons:<= 2.3.1

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2022-32533
https://lists.apache.org/thread/d3g248pr03x8rvmh8p2t3xdlw0wn5dz2
https://www.openwall.com/lists/oss-security/2022/07/06/1
http://www.openwall.com/lists/oss-security/2022/07/06/1
https://github.com/advisories/GHSA-h975-r69h-4w9p