What is CVE-2022-28730?

CVE-2022-28730 is an XSS vulnerability in Apache JSPWiki that allows an attacker to execute JavaScript in a victim's browser and obtain sensitive information.

How does CVE-2022-28730 work?

CVE-2022-28730 can be triggered by a carefully crafted request on AJAXPreview.jsp, which then allows the attacker to execute malicious JavaScript code in the victim's browser.

What is the impact of CVE-2022-28730?

The impact of CVE-2022-28730 is that an attacker can execute code on the victim's browser, potentially leading to data theft or unauthorized actions.

How can I fix CVE-2022-28730?

To fix CVE-2022-28730, it is recommended to upgrade Apache JSPWiki to version 2.11.4 or apply the appropriate patch provided by the vendor.

Is CVE-2022-28730 a high severity vulnerability?

No, CVE-2022-28730 has a medium severity rating with a CVSS score of 6.1.

Vulnerability/
CVE-2022-28730

medium

6.1

CWE

4/8/2022

3/8/2024

CVE-2022-28730: Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp

First published: Thu Aug 04 2022(Updated: )

A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This vulnerability leverages CVE-2021-40369, where the Denounce plugin dangerously renders user-supplied URLs. Upon re-testing CVE-2021-40369, it appears that the patch was incomplete as it was still possible to insert malicious input via the Denounce plugin. Apache JSPWiki users should upgrade to 2.11.3 or later.

Credit: security@apache.org

Affected Software	Affected Version	How to fix
Apache JSPWiki	<2.11.3

Never miss a vulnerability like this again

Reference Links

https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732

Frequently Asked Questions

What is CVE-2022-28730?
CVE-2022-28730 is an XSS vulnerability in Apache JSPWiki that allows an attacker to execute JavaScript in a victim's browser and obtain sensitive information.
How does CVE-2022-28730 work?
CVE-2022-28730 can be triggered by a carefully crafted request on AJAXPreview.jsp, which then allows the attacker to execute malicious JavaScript code in the victim's browser.
What is the impact of CVE-2022-28730?
The impact of CVE-2022-28730 is that an attacker can execute code on the victim's browser, potentially leading to data theft or unauthorized actions.
How can I fix CVE-2022-28730?
To fix CVE-2022-28730, it is recommended to upgrade Apache JSPWiki to version 2.11.4 or apply the appropriate patch provided by the vendor.
Is CVE-2022-28730 a high severity vulnerability?
No, CVE-2022-28730 has a medium severity rating with a CVSS score of 6.1.

collector/nvd-index
agent/type
collector/mitre-cve
source/MITRE
agent/severity
agent/references
agent/last-modified-date
agent/weakness
agent/author
agent/title
agent/softwarecombine
agent/description
agent/event
agent/tags
agent/first-publish-date
vendor/apache
canonical/apache jspwiki

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.