Description
Cross-site scripting (XSS) vulnerability in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Server 3.1 | cobbler | 2.6.6-5.10.4 | SUSE-SU-2018:1751-1 |
| SUSE Manager Server 3.1 | dwr | 3.0rc2+svn4059-0.12.3.10 | SUSE-SU-2018:1743-1 |
| SUSE Manager Server 3.1 | google-gson | 2.8.2-3.3.6 | SUSE-SU-2018:1751-1 |
| SUSE Manager Server 3.1 | patterns-suse-manager | 3.1-3.3.2 | SUSE-SU-2018:1751-1 |
| SUSE Manager Server 3.1 | prometheus-client-java | 0.3.0-1.3.5 | SUSE-SU-2018:1751-1 |
| SUSE Manager Server 3.1 | py26-compat-salt | 2016.11.4-1.7.2 | SUSE-SU-2018:1751-1 |
| SUSE Manager Server 3.1 | salt-netapi-client | 0.14.0-3.9.5 | SUSE-SU-2018:1751-1 |
| SUSE Manager Server 3.1 | spacewalk-backend | 2.7.73.13-2.19.5 | SUSE-SU-2018:1751-1 |
| SUSE Manager Server 3.1 | spacewalk-branding | 2.7.2.13-2.19.5 | SUSE-SU-2018:1751-1 |
| SUSE Manager Server 3.1 | spacewalk-certs-tools | 2.7.0.10-2.12.4 | SUSE-SU-2018:1751-1 |
| SUSE Manager Server 3.1 | spacewalk-java | 2.7.46.14-2.25.1 | SUSE-SU-2018:1751-1 |
| SUSE Manager Server 3.1 | spacewalk-utils | 2.7.10.7-2.10.4 | SUSE-SU-2018:1751-1 |
| SUSE Manager Server 3.1 | spacewalk-web | 2.7.1.16-2.19.5 | SUSE-SU-2018:1751-1 |
| SUSE Manager Server 3.1 | susemanager | 3.1.14-2.19.5 | SUSE-SU-2018:1751-1 |
| SUSE Manager Server 3.1 | susemanager-docs_en | 3.1-10.20.7 | SUSE-SU-2018:1751-1 |
| SUSE Manager Server 3.1 | susemanager-frontend-libs | 3.1.1-3.3.2 | SUSE-SU-2018:1751-1 |
| SUSE Manager Server 3.1 | susemanager-schema | 3.1.17-2.23.3 | SUSE-SU-2018:1751-1 |
| SUSE Manager Server 3.1 | susemanager-sls | 3.1.17-2.23.2 | SUSE-SU-2018:1751-1 |
| SUSE Manager Server 3.1 | susemanager-sync-data | 3.1.14-2.23.2 | SUSE-SU-2018:1751-1 |
| SUSE Manager Server 3.1 | susemanager-tftpsync | 3.1.3-3.6.2 | SUSE-SU-2018:1751-1 |
| SUSE Manager Server 3.0 | dwr | 3.0rc2+svn4059-0.12.3.1 | SUSE-SU-2018:1745-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.directwebremoting:dwr | < 2.0.11 | 2.0.11 | GHSA-q5v2-2v66-6hwm |
| Maven | org.directwebremoting:dwr | >= 3.0.M1, < 3.0.RC3 | 3.0.RC3 | GHSA-q5v2-2v66-6hwm |
Advisories 3
- SUSE-SU-2018:1743-1 Security update for dwr SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:1745-1 Security update for dwr SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:1751-1 Security update for SUSE Manager Server 3.1 SUSE / openSUSE Security Updates · Feb 4, 2026
References
- JVN#52422792 third-party-advisory
- JVNDB-2014-000118 third-party-advisory