[CVE-2019-0225] Apache JSPWiki Local File Inclusion (limited ROOT folder) vulnerability leads to user information disclosure#

Severity
High

Vendor
The Apache Software Foundation

Versions Affected
Apache JSPWiki up to 2.11.0.M2

Description
A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki, which could be used by an attacker to obtain registered users' details.

ref: JSPWIKI-1095

Mitigation
Apache JSPWiki users should upgrade to 2.11.0.M3 or later.

Credit
This issue was discovered by Muthukumar Marikani, from ZOHO-CRM Security Team