CVE-2022-28731
Apache JSPWiki CSRF in UserPreferences.jsp
CVE-2022-28731 is a medium vulnerability (CVSS 6.5) in Apache Jspwiki, published August 4, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 58.7%, the 99th percentile. Fixed in org.apache.jspwiki:jspwiki-main 2.11.3.
- Severity
- 6.5 MediumCVSS 3.1, NVD
- Exploit chance
- 58.7%EPSS, 99th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.11.3org.apache.jspwiki:jspwiki-main +1 more
Description
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.jspwiki:jspwiki-mainMaven | before 2.11.3 | 2.11.3 |
org.apache.jspwiki:jspwiki-mainMaven | before 2.11.3, plus listed versions 2.11.02.11.0.M12.11.0.M22.11.0.M32.11.0.M4 Show 6 moreShow less2.11.0.M52.11.0.M62.11.0.M72.11.0.M82.11.12.11.2 | 2.11.3 |
What each source reports
NVD Score used
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
- Record
CVE-2022-28731- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE ListNo score
Apache JSPWiki CSRF in UserPreferences.jsp
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
- Record
CVE-2022-28731- Updated
- 2026-11-02
EUVDEUVD-2022-6527No score
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
- Record
EUVD-2022-6527- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9x9j-vrhj-v364
Apache JSPWiki CSRF due to crafted request on UserPreferences.jsp
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
- Record
GHSA-9x9j-vrhj-v364- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVGHSA-9x9j-vrhj-v364
Apache JSPWiki CSRF due to crafted request on UserPreferences.jsp
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
- Record
GHSA-9x9j-vrhj-v364- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVNo score
Apache JSPWiki CSRF in UserPreferences.jsp
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
- Record
CVE-2022-28731- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.