Description
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
Remediation
References
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732
Related Vulnerabilities
CVE-2023-50776 Vulnerability in maven package com.cloudtp.jenkins:paaslane-estimate
CVE-2012-5887 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core
CVE-2021-33813 Vulnerability in maven package org.jdom:jdom
CVE-2021-32730 Vulnerability in maven package org.xwiki.platform:xwiki-platform-administration-ui
CVE-2017-7561 Vulnerability in maven package org.jboss.resteasy:resteasy-jaxrs