Description

A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.

Remediation

References

https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732

Related Vulnerabilities

CVE-2018-14042 Vulnerability in maven package org.webjars.bower:bootstrap-sass

CVE-2015-5208 Vulnerability in npm package cordova-ios

CVE-2023-35161 Vulnerability in maven package org.xwiki.platform:xwiki-platform-appwithinminutes-ui

CVE-2022-34200 Vulnerability in maven package com.convertigo.jenkins.plugins:convertigo-mobile-platform

CVE-2020-2220 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

Severity

High

Classification

CWE-352 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Tags

Not Applicable Vendor Advisory