Apache JSPWiki Cross-Site Scripting Vulnerability in Header Link Processing

A cross-site scripting (XSS) vulnerability has been identified in Apache JSPWiki versions prior to 2.12.2. This issue arises when a user creates a header link using wiki markup syntax, allowing an attacker to execute JavaScript in the victim's browser and potentially access sensitive information about the victim. Further investigation revealed that the markdown parser is also susceptible to this type of attack.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the victim's browser.

Remediation

Users of Apache JSPWiki are advised to upgrade to version 2.12.3 or later.