CVE-2022-28731
Apache JSPWiki CSRF in UserPreferences.jsp
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
- Record
CVE-2022-28731- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
Apache JSPWiki CSRF in UserPreferences.jsp
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
- Record
CVE-2022-28731- Updated
- 2026-11-02
EUVDEUVD-2022-6527 No score
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
- Record
EUVD-2022-6527- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9x9j-vrhj-v364
Apache JSPWiki CSRF due to crafted request on UserPreferences.jsp
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
- Record
GHSA-9x9j-vrhj-v364- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVGHSA-9x9j-vrhj-v364
Apache JSPWiki CSRF due to crafted request on UserPreferences.jsp
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
- Record
GHSA-9x9j-vrhj-v364- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV No score
Apache JSPWiki CSRF in UserPreferences.jsp
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
- Record
CVE-2022-28731- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.jspwiki:jspwiki-mainMaven |
before 2.11.3 | 2.11.3 |
org.apache.jspwiki:jspwiki-mainMaven |
before 2.11.3, plus listed versions 2.11.02.11.0.M12.11.0.M22.11.0.M32.11.0.M4 Show 6 moreShow less2.11.0.M52.11.0.M62.11.0.M72.11.0.M82.11.12.11.2 |
2.11.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-28731 is a medium vulnerability (CVSS 6.5) in Apache Jspwiki, published August 4, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 58.7%, the 99th percentile. Fixed in org.apache.jspwiki:jspwiki-main 2.11.3.