GHSA-9x9j-vrhj-v364

ghsaUSosv

Apache JSPWiki CSRF due to crafted request on UserPreferences.jsp

view advisory published 2022-08-05Licence: CC-BY-4.0

A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-28731US	medium6.5	58.7% (99th)	—	2022-08-04
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associate…

references

External citations — patches, advisories, analysis.

https://github.com/apache/jspwikiPACKAGE
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732WEB
https://nvd.nist.gov/vuln/detail/CVE-2022-28731ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan