CVE-2022-46907

Apache JSPWiki: XSS Injection points in several plugins

6.1 MediumPublic exploitFix available

A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.0 or later.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

1.16%Up 1.1 points since May 25, 2023

What each source reports

NVD Score used 6.1

Record: CVE-2022-46907
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Apache JSPWiki: XSS Injection points in several plugins

Record: CVE-2022-46907
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2023-1614 0.0

Record: EUVD-2023-1614
CVSS: 0.0 NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qvq8-cw7f-m7m4 6.1

Apache JSPWiki vulnerable to cross-site scripting on several plugins

Record: GHSA-qvq8-cw7f-m7m4
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVGHSA-qvq8-cw7f-m7m4 6.1

Apache JSPWiki vulnerable to cross-site scripting on several plugins

Record: GHSA-qvq8-cw7f-m7m4
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV No score

Apache JSPWiki: XSS Injection points in several plugins

Record: CVE-2022-46907
Weakness: CWE-79
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.jspwiki:jspwiki-main` Maven	before 2.12.0	2.12.0
`org.apache.jspwiki:jspwiki-war` Maven	before 2.12.0	2.12.0
`org.apache.jspwiki:jspwiki-main` Maven	before 2.12.0, plus listed versions 2.11.02.11.0.M12.11.0.M22.11.0.M32.11.0.M4 Show 7 moreShow less 2.11.0.M52.11.0.M62.11.0.M72.11.0.M82.11.12.11.22.11.3	2.12.0
`org.apache.jspwiki:jspwiki-war` Maven	before 2.12.0, plus listed versions 2.10.02.10.12.10.22.10.32.10.4 Show 13 moreShow less 2.10.52.11.02.11.0.M12.11.0.M22.11.0.M32.11.0.M42.11.0.M52.11.0.M62.11.0.M72.11.0.M82.11.12.11.22.11.3	2.12.0

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	shoucheng3/apache__jspwiki_CVE-2022-46907_2-11-3	2025-08-17

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-46907 is a medium vulnerability (CVSS 6.1) in Apache Jspwiki, published May 25, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.16%, the 67th percentile. Fixed in org.apache.jspwiki:jspwiki-main 2.12.0.

References

Show 9 moreShow less