Description
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
Remediation
References
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732
Related Vulnerabilities
CVE-2018-16131 Vulnerability in maven package com.typesafe.akka:akka-http-core_2.11
CVE-2022-36886 Vulnerability in maven package org.jenkins-ci.plugins:external-monitor-job
CVE-2020-1912 Vulnerability in npm package hermes-engine
CVE-2017-15697 Vulnerability in maven package org.apache.nifi:nifi-web-error
CVE-2018-11804 Vulnerability in maven package org.apache.spark:spark-core_2.11