Description

A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.

Remediation

References

https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732

Related Vulnerabilities

CVE-2020-26217 Vulnerability in maven package xstream:xstream

CVE-2018-1999030 Vulnerability in maven package org.jenkins-ci.plugins:maven-artifact-choicelistprovider

CVE-2022-31175 Vulnerability in npm package @ckeditor/ckeditor5-markdown-gfm

CVE-2021-21162 Vulnerability in npm package electron

CVE-2021-22113 Vulnerability in maven package org.springframework.cloud:spring-cloud-netflix-zuul

Severity

High

Classification

CWE-352 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Tags

Not Applicable Vendor Advisory