Description

A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.

Remediation

References

https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732

Related Vulnerabilities

CVE-2022-22969 Vulnerability in maven package org.springframework.security.oauth:spring-security-oauth-parent

CVE-2018-1000192 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2023-37945 Vulnerability in maven package io.jenkins.plugins:miniorange-saml-sp

CVE-2021-45029 Vulnerability in maven package org.apache.shenyu:shenyu-common

CVE-2015-5344 Vulnerability in maven package org.apache.camel:camel-xstream

Severity

High

Classification

CWE-352 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Tags

Not Applicable Vendor Advisory