CVE-2022-24947
Apache JSPWiki CSRF Account Takeover
Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later.
- Record
CVE-2022-24947- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
Apache JSPWiki CSRF Account Takeover
Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later.
- Record
CVE-2022-24947- Updated
- 2026-11-02
EUVDEUVD-2022-0800 No score
Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later.
- Record
EUVD-2022-0800- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4284-x26r-4hhc
Cross Site Request Forgery in Apache JSPWiki
Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later.
- Record
GHSA-4284-x26r-4hhc- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVGHSA-4284-x26r-4hhc
Cross Site Request Forgery in Apache JSPWiki
Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later.
- Record
GHSA-4284-x26r-4hhc- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV No score
Apache JSPWiki CSRF Account Takeover
Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later.
- Record
CVE-2022-24947- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.jspwiki:jspwiki-mainMaven |
before 2.11.2 | 2.11.2 |
org.apache.jspwiki:jspwiki-mainMaven |
before 2.11.2, plus listed versions 2.11.02.11.0.M12.11.0.M22.11.0.M32.11.0.M4 Show 5 moreShow less2.11.0.M52.11.0.M62.11.0.M72.11.0.M82.11.1 |
2.11.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-24947 is a high vulnerability (CVSS 8.8) in Apache Jspwiki, published February 25, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.16%, the 67th percentile. Fixed in org.apache.jspwiki:jspwiki-main 2.11.2.