Description
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
Remediation
References
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732
Related Vulnerabilities
CVE-2015-3250 Vulnerability in maven package org.apache.directory.api:api-ldap-client-all
CVE-2020-11995 Vulnerability in maven package com.caucho:hessian
CVE-2023-22467 Vulnerability in maven package org.webjars.npm:luxon
CVE-2018-1999034 Vulnerability in maven package com.inedo.proget:inedo-proget
CVE-2023-29514 Vulnerability in maven package org.xwiki.platform:xwiki-platform-administration-ui