CVE-2022-28731

Published: Aug 4, 2022Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.

Affected (1)

Products: Apache: Jspwiki

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Jspwiki	Before 2.11.3

Related CWEs

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (2)

https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732

Source: security@apache.org

Not ApplicableVendor Advisory

https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732

Source: af854a3a-2127-422b-91ae-364da2661108

Not ApplicableVendor Advisory

Timeline

No history available yet.