CVE-2022-32533: Apache Jetspeed

Critical severity, CVSS 9.8. EPSS: 4.1% chance of exploitation in the next 30 days.

Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant project of Apache Portals and no updates will be provided for this issue

Affected products

Published 2022-07-06. Last modified 2026-06-17.