CVE-2021-36738

—

CVSS 3.1

6.1 medium

EPSS

2%p82

Published

Jan 6, 2022 (Jan 6, 2022)

Modified

Jun 17, 2026

Description

The input fields in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the applicant-mvcbean-cdi-jsp-portlet.war artifact

Vendors: apache
Products: pluto
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (2.3%)

In the news0 stories

No ingested article mentions this CVE yet.