Description
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
Remediation
References
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732
Related Vulnerabilities
CVE-2018-1000151 Vulnerability in maven package org.jenkins-ci.plugins:vsphere-cloud
CVE-2020-13931 Vulnerability in maven package org.apache.tomee:openejb-loader
CVE-2020-2256 Vulnerability in maven package org.jenkins-ci.plugins:pipeline-maven-parent
CVE-2020-12480 Vulnerability in maven package com.typesafe.play:play_2.13
CVE-2023-39685 Vulnerability in maven package org.hjson:hjson