What is CVE-2022-28731?

CVE-2022-28731 is a medium-severity vulnerability in Apache Jspwiki, classified under Cross-Site Request Forgery (CSRF). CVSS score: 6.5/10. Published 2022-08-04.

How severe is CVE-2022-28731?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Is CVE-2022-28731 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

CSRF in Apache Jspwiki

CVE-2022-28731

A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password requ…

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.563 (99.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N.

Affected products

Apache Jspwiki
Apache Software Foundation Jspwiki — versions Apache JSPWiki

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

Public proof-of-concept exploits

References

security@apache.org (x_refsource_MISC, Not Applicable, Vendor Advisory)

Frequently asked questions

What is CVE-2022-28731?: CVE-2022-28731 is a medium-severity vulnerability in Apache Jspwiki, classified under Cross-Site Request Forgery (CSRF). CVSS score: 6.5/10. Published 2022-08-04.
How severe is CVE-2022-28731?: Medium severity. CVSS v3 base score is 6.5 out of 10.
Is CVE-2022-28731 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.