Apache Pluto vulnerabilities
6 CVEs affecting Apache Pluto, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-36739, published 2022-01-06.
More from Apache.
Highest priority
Known exploited (CISA KEV) first, then by EPSS exploit probability.
- CVE-2018-1306, published 2018-06-27. High severity, CVSS 7.5. EPSS: 43.5% chance of exploitation in the next 30 days. The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict path…
- CVE-2019-0186, published 2019-04-26. Medium severity, CVSS 6.1. EPSS: 20.6% chance of exploitation in the next 30 days. The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks. Mitigation: * Uninstall the ChatRoomDemo war file - or - * migrate…
- CVE-2021-36739, published 2022-01-06. Medium severity, CVSS 6.1. EPSS: 2.3% chance of exploitation in the next 30 days. The "first name" and "last name" fields of the Apache Pluto 3.1.0 MVCBean JSP portlet maven archetype are vulnerable to Cross-Site Scripting (XSS) attacks.
- CVE-2021-36738, published 2022-01-06. Medium severity, CVSS 6.1. EPSS: 2.3% chance of exploitation in the next 30 days. The input fields in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the…
- CVE-2021-36737, published 2022-01-06. Medium severity, CVSS 6.1. EPSS: 2.3% chance of exploitation in the next 30 days. The input fields of the Apache Pluto UrlTestPortlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the v3-demo-portlet.war artifact
- CVE-2020-15250, published 2020-10-12. Medium severity, CVSS 5.5. EPSS: 1.7% chance of exploitation in the next 30 days. In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared…