org.apache.portals.pluto CVEs · Working exploit published

Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 2 100.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 0 0.0% Withdrawn CVE 0 0.0%

Critical 0 0.0% High 1 50.0% Medium 1 50.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 2 100.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 2 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%

split by StatusSeverityProtectionExploit maturity peak 1 / month

Jun 181 Mitigation candidate1 High1 not blocked1 Working exploit published1 Jul 180 Aug 180 Sep 180 Oct 180 Nov 180 Dec 180 Jan 190 Feb 190 Mar 190 Apr 191 Mitigation candidate1 Medium1 not blocked1 Working exploit published1

Jun 18Jul 18Aug 18Sep 18Oct 18Nov 18Dec 18Jan 19Feb 19Mar 19Apr 19

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2019-0186	Medium	2019-04-26	Mitigation candidate	Working exploit published	The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks. Mitigation: * Uninstall the ChatRoomDemo war file - or - * migrate to version 3.1.0 of the chat-room-demo war file
CVE-2018-1306	High	2018-06-27	Mitigation candidate	Working exploit published	The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict path information provided during a file upload. An attacker could exploit this vulnerability to obtain configuration data and other sensitive information.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2019-0186

Medium

2019-04-26

Mitigation candidate

Working exploit published

The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks. Mitigation: * Uninstall the ChatRoomDemo war file - or - * migrate to version 3.1.0 of the chat-room-demo war file

CVE-2018-1306

High

2018-06-27

Mitigation candidate

Working exploit published

The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict path information provided during a file upload. An attacker could exploit this vulnerability to obtain configuration data and other sensitive information.