Apache.JSPWiki.UserPreferences.jsp.CSRF

Description

This indicates an attack attempt to exploit a Cross-Site Request Forgery Vulnerability in Apache Software Foundation JSPWiki.
This vulnerability is due to a design flaw allowing user profile changes without a password or CSRF token. A remote attacker could exploit this vulnerability by enticing a target user into loading a malicious URL. Successful exploitation could result in modification of the email of the target user, allowing account compromise through a password reset request.

Affected Products

Apache Software Foundation JSPWiki prior to 2.11.3

Impact

System Compromise: Remote attackers can gain control of vulnerable systems.

Recommended Actions

Apply the most recent upgrade or patch from the vendor.
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28731

CVE References