{"id":"CVE-2019-0225","details":"A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, which could be used by an attacker to obtain registered users' details.","aliases":["GHSA-pffw-p2q5-w6vh"],"modified":"2026-09-11T14:15:08.738751Z","published":"2019-03-28T22:29:00.683Z","references":[{"type":"WEB","url":"https://lists.apache.org/thread.html/03ddbcb1d6322e04734e65805a147a32bcfdb71b8fc5821fb046ba8d%40%3Cannounce.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/4f19fdbd8b9c4caf6137a459d723f4ec60379b033ed69277eb4e0af9%40%3Cuser.jspwiki.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/6251c06cb11e0b495066be73856592dbd7ed712487ef283d10972831%40%3Cdev.jspwiki.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/aac253cfc33c0429b528e2fcbe82d3a42d742083c528f58d192dfd16%40%3Ccommits.jspwiki.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/e42d6e93384d4a33e939989cd00ea2a06ccf1e7bb1e6bdd3bf5187c1%40%3Ccommits.jspwiki.apache.org%3E"},{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2019/03/26/2"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/107627"},{"type":"ADVISORY","url":"https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-0225"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/jspwiki","events":[{"introduced":"6144474e52dcfa101c181a5ee0ebf9a7c9c53d17"},{"fixed":"b9c3d919beee3a73ffd87cde5021327d3a6544a5"},{"introduced":"b9c3d919beee3a73ffd87cde5021327d3a6544a5"},{"last_affected":"d48bcef107a14dd07ecd830ab817b8df796082a4"}],"database_specific":{"cpe":["cpe:2.3:a:apache:jspwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:apache:jspwiki:2.11.0:-:*:*:*:*:*:*","cpe:2.3:a:apache:jspwiki:2.11.0:milestone1-rc1:*:*:*:*:*:*","cpe:2.3:a:apache:jspwiki:2.11.0:milestone1-rc2:*:*:*:*:*:*","cpe:2.3:a:apache:jspwiki:2.11.0:milestone1-rc3:*:*:*:*:*:*","cpe:2.3:a:apache:jspwiki:2.11.0:milestone2:*:*:*:*:*:*","cpe:2.3:a:apache:jspwiki:2.11.0:milestone2-rc1:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2.9.0"},{"fixed":"2.11.0"},{"introduced":"2.11.0-NA"},{"last_affected":"2.11.0-NA"},{"introduced":"2.11.0-milestone1\\-rc1"},{"last_affected":"2.11.0-milestone1\\-rc1"},{"introduced":"2.11.0-milestone1\\-rc2"},{"last_affected":"2.11.0-milestone1\\-rc2"},{"introduced":"2.11.0-milestone1\\-rc3"},{"last_affected":"2.11.0-milestone1\\-rc3"},{"introduced":"2.11.0-milestone2"},{"last_affected":"2.11.0-milestone2"},{"introduced":"2.11.0-milestone2\\-rc1"},{"last_affected":"2.11.0-milestone2\\-rc1"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["2.11.0-NA","2.11.0-milestone1\\-rc1","2.11.0-milestone1\\-rc2","2.11.0-milestone1\\-rc3","2.11.0-milestone2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-0225.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}