CVE-2019-0186 Cross-site Scripting in Apache Pluto Chatroom demo

What is CVE-2019-0186?

CVE-2019-0186 is a medium-severity cross-site scripting vulnerability in Apache Pluto, published on 26 Apr 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks. Mitigation: * Uninstall the ChatRoomDemo war file - or - * migrate to version 3.1.0 of the chat-room-demo war file

Weakness: CWE-79

Which versions are affected by CVE-2019-0186?

2 open source packages ship an affected version, including org.apache.portals.pluto:chatRoomDemo. It affects 1 product.

Products include Apache Pluto.

How do I fix CVE-2019-0186?

Upgrade org.apache.portals.pluto:chatRoomDemo to 3.1.0 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2019-0186 being exploited?

There is no known exploitation of CVE-2019-0186 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in Apache Pluto

• CVE-2018-1306 Exposure of Sensitive Information in Apache Pluto High 7.5
• CVE-2021-36737 XSS in V3 Demo Portlet Medium 6.1
• CVE-2021-36738 XSS vulnerability in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet Medium 6.1
• CVE-2021-36739 XSS vulnerability in the MVCBean JSP portlet maven archetype Medium 6.1
• CVE-2020-15250 Information disclosure in JUnit4 Medium 4.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w47g-4vrc-m3w2.