CVE-2022-34158: User Group Privilege Escalation
A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege escalation of the attacker's account. Further examination of this issue established that it could also be used to modify the email associated with the attacked account, and then a reset password request from the login page.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this Apache JSPWiki CSRF vulnerability?
The vulnerability ID for this Apache JSPWiki CSRF vulnerability is CVE-2022-34158.
What is the severity of CVE-2022-34158?
CVE-2022-34158 has a severity score of 8.8, which is considered high.
How does the CSRF vulnerability on Apache JSPWiki before version 2.11.3 occur?
The CSRF vulnerability on Apache JSPWiki before version 2.11.3 occurs due to a carefully crafted invocation on the Image plugin.
What can an attacker achieve with this CSRF vulnerability?
An attacker can exploit this CSRF vulnerability to escalate their account privileges within a group and potentially modify the associated email.
How can I fix the CSRF vulnerability on Apache JSPWiki before version 2.11.3?
To fix the CSRF vulnerability on Apache JSPWiki before version 2.11.3, update to version 2.11.3 or later.