Description

A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.

Remediation

References

https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732

Related Vulnerabilities

CVE-2013-2160 Vulnerability in maven package org.apache.cxf:cxf-parent

CVE-2015-3250 Vulnerability in maven package org.apache.directory.api:api-ldap-model

CVE-2023-24425 Vulnerability in maven package com.cloudbees.jenkins.plugins:kubernetes-credentials-provider

CVE-2017-4991 Vulnerability in maven package org.cloudfoundry.identity:cloudfoundry-identity-uaa

CVE-2018-1000184 Vulnerability in maven package com.coravy.hudson.plugins.github:github

Severity

High

Classification

CWE-352 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Tags

Not Applicable Vendor Advisory