Description
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
Remediation
References
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732
Related Vulnerabilities
CVE-2019-10362 Vulnerability in maven package io.jenkins:configuration-as-code
CVE-2020-27838 Vulnerability in maven package org.keycloak:keycloak-server-spi-private
CVE-2021-40331 Vulnerability in maven package org.apache.ranger:ranger-hive-plugin
CVE-2020-13925 Vulnerability in maven package org.apache.kylin:kylin-server
CVE-2018-12540 Vulnerability in maven package io.vertx:vertx-web