Vulnerabilities

Apache Software Foundation Pluto

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

6CVEs

CVE-2018-1306

The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict path information provided during a file upload. An attacker could exploit this vulnerability to obtain configuration data and other sensitive information.

Published 2018-06-27 · Modified

7.51 PoCEPSS 0.435

CVE-2019-0186

The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks. Mitigation: * Uninstall the ChatRoomDemo war file - or - * migrate to version 3.1.0 of the chat-room-demo war file

Published 2019-04-26 · Modified

6.11 PoCEPSS 0.206

CVE-2021-36737

XSS in V3 Demo Portlet

Published 2022-01-06 · Modified

6.1EPSS 0.023

CVE-2021-36738

XSS vulnerability in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet

Published 2022-01-06 · Modified

6.1EPSS 0.023

CVE-2021-36739

XSS vulnerability in the MVCBean JSP portlet maven archetype