Description
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
Remediation
References
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732
Related Vulnerabilities
CVE-2016-3722 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2023-37478 Vulnerability in npm package @pnpm/exe
CVE-2015-2156 Vulnerability in maven package io.netty:netty-all
CVE-2012-5633 Vulnerability in maven package org.apache.cxf:cxf-api
CVE-2019-25027 Vulnerability in maven package com.vaadin:flow-server