CVE-2026-28813
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Apache JSPWiki up to version 2.12.3 is vulnerable to JSON Hijacking, which leads to CSRF vulnerabilities. An attacker can exploit this to perform unauthorized actions on behalf of a user.
Risk Assessment
An attacker can trick an authenticated user into performing unwanted actions, potentially leading to data integrity compromise.
Recommendation
It is recommended to upgrade Apache JSPWiki to version 2.12.4, which fixes the issue.
Other vulnerabilities in Apache JSPWiki
See all- CVE-2026-28812Critical
Apache JSPWiki up to version 2.12.3 lacks checks in UserManager, allowing impersonation. An attacker can escalate privileges.
- CVE-2026-48910Medium
An XSS vulnerability in Apache JSPWiki allows an attacker to inject malicious JavaScript via a crafted editing request, exploiting parsing errors in the Markdown renderer. This could lead to session hijacking and theft of sensitive data.
- CVE-2026-28814High
Apache JSPWiki up to version 2.12.3 is vulnerable to arbitrary Wiki markup rendering due to lack of authentication. An attacker can obtain sensitive data stored in JSPWiki variables.
- CVE-2026-28811High
Apache JSPWiki up to version 2.12.3 reveals unnecessary information in debug messages. This can lead to leakage of sensitive data.
Original NVD description (English source)
Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities. Users are recommended to upgrade to version 2.12.4, which fixes this issue.