CVE-2019-0186
Medium · 6.1CVSS
6.1
EPSS
20.6%
Published
Apr 26, 2019
CISA due date
—
The record
The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks. Mitigation: * Uninstall the ChatRoomDemo war file - or - * migrate to version 3.1.0 of the chat-room-demo war file
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.portals.pluto:chatRoomDemo | 3.0.0 | 3.1.0 |
| maven | org.apache.portals.pluto/chatRoomDemo | 3.0.0 | 3.1.0 |
| maven | org.apache.portals.pluto/pluto-container | 3.0.0 | No fix |
Related vulnerabilities
- CVE-2018-1306 The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto… Also affects org.apache.portals.pluto/pluto-container
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96362 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96360 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96357 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79