CVE-2022-32533
Published: 06 July 2022
Summary
CVE-2022-32533 is a critical-severity Cross-site Scripting (CWE-79) vulnerability in Apache Jetspeed. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 7.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Apache Jetspeed-2 contains a default configuration that fails to adequately filter untrusted user input. This affects the Apache Portals component and produces multiple related weaknesses, principally cross-site scripting, cross-site request forgery, XML external entity injection, and server-side request forgery.
Remote attackers without authentication or user interaction can exploit the flaw over the network to read or modify sensitive data and potentially take full control of affected instances, consistent with the CVSS 9.8 rating. The same input-handling gap enables the listed injection and forgery attacks.
Advisories note that enabling the configuration option “xss.filter.post = true” may reduce exposure, yet Apache Jetspeed is a dormant project that will receive no further updates or patches for the issue.
EPSS scores rose from a low baseline to a peak of 0.1155 before receding to the current value of 0.0923, indicating a measurable but temporary increase in observed exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-6346
Vulnerability details
Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant…
more
project of Apache Portals and no updates will be provided for this issue
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.