Cross-site Scripting in Apache Pluto

MEDIUM 6.1CVE-2021-36739 · GHSA-3qp6-m7hp-jrwf · Published 06/01/2022 · updated 17/06/2026

In short

CVE-2021-36739 is a MEDIUM (CVSS 6.1) vulnerability affecting org.apache.portals.pluto:pluto-portal, pluto (apache).
Chance of exploitation in the next 30 days (EPSS): 2.4%, higher than 84.1% of all vulnerabilities.
Fix: update to 3.1.1 or later.

Package	Affected versions	Patched versions
org.apache.portals.pluto:pluto-portal Maven	`< 3.1.1`	`3.1.1`
pluto apache	`= 3.1.0`	No fix yet

Description

The "first name" and "last name" fields of the Apache Pluto 3.1.0 MVCBean JSP portlet maven archetype are vulnerable to Cross-Site Scripting (XSS) attacks.

NVD description

The "first name" and "last name" fields of the Apache Pluto 3.1.0 MVCBean JSP portlet maven archetype are vulnerable to Cross-Site Scripting (XSS) attacks.

References

nvd.nist.gov/vuln/detail/CVE-2021-36739 · ADVISORY
apache/portals-pluto · PACKAGE
lists.apache.org/thread/m5j87nn1lmvzp8b9lmh7gqq68g5lnb7p · WEB

More vulnerabilities in org.apache.portals.pluto:pluto-portal

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free