CVE-2026-28811
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Apache JSPWiki up to version 2.12.3 reveals unnecessary information in debug messages. This can lead to leakage of sensitive data.
Risk Assessment
An attacker can use the disclosed information for further attacks or to gain access to confidential data.
Recommendation
It is recommended to upgrade Apache JSPWiki to version 2.12.4, which fixes the issue.
Other vulnerabilities in Apache JSPWiki
See all- CVE-2026-28812Critical
Apache JSPWiki up to version 2.12.3 lacks checks in UserManager, allowing impersonation. An attacker can escalate privileges.
- CVE-2026-48910Medium
An XSS vulnerability in Apache JSPWiki allows an attacker to inject malicious JavaScript via a crafted editing request, exploiting parsing errors in the Markdown renderer. This could lead to session hijacking and theft of sensitive data.
- CVE-2026-28814High
Apache JSPWiki up to version 2.12.3 is vulnerable to arbitrary Wiki markup rendering due to lack of authentication. An attacker can obtain sensitive data stored in JSPWiki variables.
- CVE-2026-28813High
Apache JSPWiki up to version 2.12.3 is vulnerable to JSON Hijacking, which leads to CSRF vulnerabilities. An attacker can exploit this to perform unauthorized actions on behalf of a user.
Original NVD description (English source)
Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes this issue.