CVE-2019-10085: Apache Allura

Medium severity, CVSS 6.1. EPSS: 5.1% chance of exploitation in the next 30 days.

In Apache Allura prior to 1.11.0, a vulnerability exists for stored XSS on the user dropdown selector when creating or editing tickets. The XSS executes when a user engages with that dropdown on that page.

Affected products

• Apache Allura: before 1.11.0 (fixed in 1.11.0)

Published 2019-06-19. Last modified 2026-06-17.