Description
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
Remediation
References
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732
Related Vulnerabilities
CVE-2022-26477 Vulnerability in maven package org.apache.systemds:systemds
CVE-2014-3656 Vulnerability in maven package org.keycloak:keycloak-services
CVE-2020-1951 Vulnerability in maven package org.apache.tika:tika-parsers
CVE-2020-2207 Vulnerability in maven package org.jenkins-ci.plugins:vncviewer
CVE-2020-10719 Vulnerability in maven package io.undertow:undertow-core