Cross-site Scripting in Apache Pluto

MITTEL 6.1CVE-2021-36737 · GHSA-x588-g38j-f672 · Published 06/01/2022 · updated 17/06/2026

Kurz gesagt

CVE-2021-36737 ist eine Schwachstelle (MITTEL (CVSS 6.1)) in org.apache.portals.pluto:pluto-portal, pluto (apache).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.4%, höher als bei 84.1% aller Schwachstellen.
Abhilfe: auf 3.1.1 oder neuer aktualisieren.

Package	Affected versions	Patched versions
org.apache.portals.pluto:pluto-portal Maven	`< 3.1.1`	`3.1.1`
pluto apache	`< 3.1.1`	`3.1.1`

Description

The input fields of the Apache Pluto UrlTestPortlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the v3-demo-portlet.war artifact

NVD description

The input fields of the Apache Pluto UrlTestPortlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the v3-demo-portlet.war artifact

References

nvd.nist.gov/vuln/detail/CVE-2021-36737 · ADVISORY
apache/portals-pluto · PACKAGE
lists.apache.org/thread/x7kt47bf358x8sg9qg02zt0dmdrtow25 · WEB

Weitere Schwachstellen in org.apache.portals.pluto:pluto-portal

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.portals.pluto:pluto-portal

Maven

< 3.1.1

3.1.1

pluto

apache

< 3.1.1

3.1.1

Description

The input fields of the Apache Pluto UrlTestPortlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the v3-demo-portlet.war artifact

NVD description

The input fields of the Apache Pluto UrlTestPortlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the v3-demo-portlet.war artifact

Weitere Schwachstellen in org.apache.portals.pluto:pluto-portal

Alle anzeigen →