Description
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
Remediation
References
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732
Related Vulnerabilities
CVE-2022-40145 Vulnerability in maven package org.apache.karaf.jaas:org.apache.karaf.jaas.modules
CVE-2022-41244 Vulnerability in maven package org.jenkins-ci.plugins:view26
CVE-2023-50773 Vulnerability in maven package com.zintow:dingding-json-pusher
CVE-2018-8041 Vulnerability in maven package org.apache.camel:camel-mail
CVE-2023-43498 Vulnerability in maven package org.jenkins-ci.main:jenkins-core