CVE-2022-32533: Apache Portals Jetspeed XSS, CSRF, SSRF, and XXE issues

["Mark J. Cox" <mjc () apache org>]

Severity: moderate

Description:

** UNSUPPORTED WHEN ASSIGNED ** Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading 
to a number of issues including XSS, CSRF, XXE, and SSRF.  Setting the configuration option "xss.filter.post = true" 
may mitigate these issues.

NOTE: Apache Jetspeed is a dormant project of Apache Portals and no updates will be provided for this issue.  

Credit:

Thanks to RunningSnail for reporting.

References:

https://lists.apache.org/thread/d3g248pr03x8rvmh8p2t3xdlw0wn5dz2