CVE-2022-28730: Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp
A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This vulnerability leverages CVE-2021-40369, where the Denounce plugin dangerously renders user-supplied URLs. Upon re-testing CVE-2021-40369, it appears that the patch was incomplete as it was still possible to insert malicious input via the Denounce plugin. Apache JSPWiki users should upgrade to 2.11.3 or later.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-28730?
CVE-2022-28730 is an XSS vulnerability in Apache JSPWiki that allows an attacker to execute JavaScript in a victim's browser and obtain sensitive information.
How does CVE-2022-28730 work?
CVE-2022-28730 can be triggered by a carefully crafted request on AJAXPreview.jsp, which then allows the attacker to execute malicious JavaScript code in the victim's browser.
What is the impact of CVE-2022-28730?
The impact of CVE-2022-28730 is that an attacker can execute code on the victim's browser, potentially leading to data theft or unauthorized actions.
How can I fix CVE-2022-28730?
To fix CVE-2022-28730, it is recommended to upgrade Apache JSPWiki to version 2.11.4 or apply the appropriate patch provided by the vendor.
Is CVE-2022-28730 a high severity vulnerability?
No, CVE-2022-28730 has a medium severity rating with a CVSS score of 6.1.