Description
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
Remediation
References
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732
Related Vulnerabilities
CVE-2016-2175 Vulnerability in maven package org.apache.pdfbox:jempbox
CVE-2022-34196 Vulnerability in maven package io.jenkins.plugins:rest-list-parameter
CVE-2018-1999007 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2021-41249 Vulnerability in npm package graphql-playground-react
CVE-2018-8014 Vulnerability in maven package org.apache.tomcat:tomcat-catalina