Apache Software Foundation Apache Portals vulnerabilities

4 vulnerabilities

Known vulnerabilities in Apache Software Foundation Apache Portals, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.1CVE-2021-36739apache software foundationapache portals+2
EPSS score
2.33%
The "first name" and "last name" fields of the Apache Pluto 3.1.0 MVCBean JSP portlet maven archetype are vulnerable to Cross-Site Scripting (XSS) attacks.6.1CVE-2021-36737apache software foundationapache portals+2
EPSS score
2.33%
The input fields of the Apache Pluto UrlTestPortlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the v3-demo-portlet.war artifact6.1CVE-2021-36738apache software foundationapache portals+2
EPSS score
2.33%
The input fields in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the applicant-mvcbean-cdi-jsp-portlet.war artifact9.8CVE-2022-32533apache software foundationapache portals+2
EPSS score
4.08%
Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant project of Apache Portals and no updates will be provided for this issue