XSS vulnerability in the MVCBean JSP portlet maven archetype
The "first name" and "last name" fields of the Apache Pluto 3.1.0 MVCBean JSP portlet maven archetype are vulnerable to Cross-Site Scripting (XSS) attacks.
XSS vulnerability in the MVCBean JSP portlet maven archetype
The "first name" and "last name" fields of the Apache Pluto 3.1.0 MVCBean JSP portlet maven archetype are vulnerable to Cross-Site Scripting (XSS) attacks.
Description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Metrics
Version
Base score
Base severity
Vector
Metrics Other Info
unknown
other:
moderate
Impacts
CAPEC ID
Description
Solutions
Configurations
Workarounds
If a project was generated from the affected maven archetype using a command like the following:
mvn archetype:generate \
-DarchetypeGroupId=org.apache.portals.pluto.archetype \
-DarchetypeArtifactId=mvcbean-jsp-portlet-archetype \
-DarchetypeVersion=3.1.0 \
-DgroupId=com.mycompany \
-DartifactId=com.mycompany.my.mvcbean.jsp.portlet
Then developers must fix the generated greeting.jspx file by escaping the rendered values submitted to the "First Name" and "Last Name" fields.
For example, change:
<span>${user.firstName} ${user.lastName}! </span>
To:
<span>${mvc.encoders.html(user.firstName)} ${mvc.encoders.html(user.lastName)}! </span>
Moving forward, all such projects should be generated from version 3.1.1 of the Maven archetype.
The "first name" and "last name" fields of the Apache Pluto 3.1.0 MVCBean JSP portlet maven archetype are vulnerable to Cross-Site Scripting (XSS) attacks.