CVE-2019-0225: apache apache jspwiki Path Traversal
CVSS: 7.8v2.0HighModified
AliasesGHSA-pffw-p2q5-w6vh
Published 28-03-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-0225 is a high (CVSS 7.8) Path Traversal vulnerability in apache apache jspwiki. EPSS estimates a 9.99% chance of exploitation in the next 30 days, higher than 95.5% of scored vulnerabilities.
CVSS score
7.8/10
010
High · v2.0 (NVD)EPSS score
9.99%
0%100%
Low · -0.27 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 28-03-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, which could be used by an attacker to obtain registered users' details.
CVSS metrics
3 scores · 2 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSourcesAll 2 agree
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
High 7.8Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:C/I:N/A:NSourcesSingle source
EPSS trend
Probability
9.99%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
-0.27 pp
From 10.26% on 18-09-2026
18-09-202618-10-2026
EPSS score9.99%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Apache2 products
- apache jspwikiApache JSPWiki 2.9.0 to 2.11.0.M2
- jspwiki≥ 2.9.0, < 2.11.0 | 2.11.0 | 2.11.0:milestone1-rc1 | 2.11.0:milestone1-rc2 | 2.11.0:milestone1-rc3 | 2.11.0:milestone2 | 2.11.0:milestone2-rc1
Org.apache.jspwiki1 product
- jspwiki-war≥ 2.9.0, < 2.11.0.M3
2 vendors · 3 products
References
15 links- www.openwall.com/lists/oss-security/2019/03/26/2Mailing ListX Refsource MLISTThird Party AdvisoryWEB
