CVE-2021-36737

EPSS 6.0%

Cross-site Scripting in Apache Pluto

Published: 1/8/2022Modified: 12/4/2024

Description

The input fields of the Apache Pluto UrlTestPortlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the v3-demo-portlet.war artifact

Affected packages (1)

Maven/org.apache.portals.pluto:pluto-portalfrom 0, < 3.1.1

References (3)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-36737
PATCHhttps://github.com/apache/portals-pluto
WEBhttps://lists.apache.org/thread/x7kt47bf358x8sg9qg02zt0dmdrtow25