CVE-2024-27136: Apache JSPWiki Upload page cross-site scripting

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe flaw is remotely reachable with no authentication and has a very high EPSS score, though it requires user interaction and no confirmed exploitation is documented.

What it is

Apache JSPWiki 2.12.1 and earlier contain a reflected/stored cross-site scripting flaw on the Upload page, allowing injected JavaScript to run in a victim's browser. The issue is fixed in JSPWiki 2.12.2 and later. Because the wiki is a shared collaboration platform, a successful attack can expose session data or other sensitive information belonging to users who view crafted content.

Impact

An attacker can execute arbitrary JavaScript in a victim's browser session, potentially stealing session cookies, authentication tokens, or other sensitive information accessible to that user. The scope change in the CVSS vector indicates the impact can extend beyond the vulnerable component to the victim's browser context.

Attack surface

Reached over the network via the JSPWiki Upload page; the CVSS vector shows no privileges required (PR:N) but user interaction is required (UI:R), meaning a victim must visit or interact with a crafted page or link. No authentication is needed to deliver the payload.

Exploitation

Not listed in CISA KEV and no public exploit or ransomware usage is documented in the record. EPSS is high (0.60846, 99.1st percentile), suggesting elevated likelihood of exploitation activity, but the record contains no confirmed in-the-wild exploitation evidence.

What to do

• Upgrade Apache JSPWiki to 2.12.2 or later as the primary fix.
• If immediate upgrade is not possible, restrict or disable the Upload page functionality until patched.
• Deploy a web application firewall or content security policy that blocks inline and injected script execution on JSPWiki pages.
• Review and sanitize any user-supplied content rendered on the Upload page.
• Monitor vendor advisories for updated guidance on CVE-2024-27136.

Detection

• Inspect web server and JSPWiki logs for suspicious script payloads or encoded JavaScript in requests to the Upload page.
• Monitor for anomalous outbound requests or cookie exfiltration patterns from browsers accessing JSPWiki.
• Use CSP violation reports to detect blocked inline script execution on JSPWiki pages.
• Review application logs for unexpected changes to uploaded content or page rendering.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.