CVE-2022-28731 Apache JSPWiki CSRF in UserPreferences.jsp

2022-08-0406:15:43

apache

www.cve.org

cve-2022-28731

apache

jspwiki

csrf

userpreferences.jsp

vulnerability

email modification

reset password

AI Score

Confidence

High

EPSS

0.001

Percentile

27.3%

JSON

A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.

CNA Affected

[
  {
    "product": "Apache JSPWiki",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "Apache JSPWiki up to 2.11.2",
        "status": "affected",
        "version": "Apache JSPWiki",
        "versionType": "custom"
      }
    ]
  }
]