Skip to content

Product

apache pluto vulnerabilities

2 published CVES affecting apache pluto, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
1
Medium
1
Low
0
Unscored
0
CISA KEV
0

Latest apache pluto CVEs

Newest publication first

  1. CVE-2019-0186 Cross-site Scripting in Apache Pluto Chatroom demo

    Published
    MediumCVSS 6.1 EPSS 20.6% Public exploit

    The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks. Mitigation: * Uninstall the ChatRoomDemo war file - or - * migrate to version 3.1.0 of the chat-room-demo war file

  2. CVE-2018-1306 Exposure of Sensitive Information in Apache Pluto

    Published
    HighCVSS 7.5 EPSS 42.3% Public exploit

    The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict path information provided during a file upload. An attacker could exploit this vulner...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.