CVE-2022-34158: A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege…

PriorityP347high8.8CVSS 3.1

AVNACLPRNUIRSUCHIHAH

EPSS

1.09%

61.5th percentile

A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege escalation of the attacker's account. Further examination of this issue established that it could also be used to modify the email associated with the attacked account, and then a reset password request from the login page.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	jspwiki	< 2.11.3	2.11.3
apache_software_foundation	apache_jspwiki	unspecified – Apache JSPWiki up to 2.11.2	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.