Description
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
Remediation
References
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732
Related Vulnerabilities
CVE-2020-14359 Vulnerability in maven package org.keycloak:keycloak-core
CVE-2023-30523 Vulnerability in maven package org.jenkins-ci.plugins:reportportal
CVE-2018-1000146 Vulnerability in maven package org.jenkins-ci.plugins:liquibase-runner
CVE-2021-43841 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore
CVE-2019-10170 Vulnerability in maven package org.keycloak:keycloak-services