Description
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
Remediation
References
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732
Related Vulnerabilities
CVE-2022-36906 Vulnerability in maven package org.jenkins-ci.plugins:openshift-deployer
CVE-2014-0034 Vulnerability in maven package org.apache.cxf.services.sts:cxf-services-sts-core
CVE-2017-1000397 Vulnerability in maven package org.jenkins-ci.main:maven-plugin
CVE-2022-28135 Vulnerability in maven package org.jvnet.hudson.plugins:instant-messaging
CVE-2014-2066 Vulnerability in maven package org.jenkins-ci.main:jenkins-core