title: Apache Portals Jetspeed XSS, CSRF, SSRF, and XXE issues
description: Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant project of Apache Portals and no updates will be provided for this issue
problem types: CWE-79: Cross-Site Scripting (XSS); CWE-352: Cross-Site Request Forgery (CSRF); CWE-918: Server-Side Request Forgery (SSRF); CWE-611: XML eXternal Entities (XXE)
affected:
{
product: Apache Portals
vendor: Apache Software Foundation
versions:
status: affected, version: Jetspeed 2.3.1
}
metrics:
other: [
content: {'other': 'moderate'}
type: unknown
]