Description
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
Remediation
References
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732
Related Vulnerabilities
CVE-2014-7810 Vulnerability in maven package org.apache.tomcat:jasper
CVE-2020-12827 Vulnerability in npm package mjml
CVE-2023-32996 Vulnerability in maven package io.jenkins.plugins:miniorange-saml-sp
CVE-2011-0013 Vulnerability in maven package org.apache.tomcat:tomcat-catalina
CVE-2019-10365 Vulnerability in maven package org.jenkins-ci.plugins:google-kubernetes-engine