CVE-2026-28814
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Apache JSPWiki up to version 2.12.3 is vulnerable to arbitrary Wiki markup rendering due to lack of authentication. An attacker can obtain sensitive data stored in JSPWiki variables.
Risk Assessment
An attacker can disclose confidential information stored in wiki variables, potentially leading to data leakage.
Recommendation
It is recommended to upgrade Apache JSPWiki to version 2.12.4 or 3.0.0, which fix the issue.
Other vulnerabilities in Apache JSPWiki
See all- CVE-2026-28812Critical
Apache JSPWiki up to version 2.12.3 lacks checks in UserManager, allowing impersonation. An attacker can escalate privileges.
- CVE-2026-48910Medium
An XSS vulnerability in Apache JSPWiki allows an attacker to inject malicious JavaScript via a crafted editing request, exploiting parsing errors in the Markdown renderer. This could lead to session hijacking and theft of sensitive data.
- CVE-2026-28813High
Apache JSPWiki up to version 2.12.3 is vulnerable to JSON Hijacking, which leads to CSRF vulnerabilities. An attacker can exploit this to perform unauthorized actions on behalf of a user.
- CVE-2026-28811High
Apache JSPWiki up to version 2.12.3 reveals unnecessary information in debug messages. This can lead to leakage of sensitive data.
Original NVD description (English source)
Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables. Users are recommended to upgrade to version 2.12.4 or 3.0.0, which fixes this issue.