EUVD-2026-51178
GHSA-4xg4-cv39-wq7w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible wiki with no auth required to trigger debug output; C:H reflects potential for sensitive runtime data exposure with no integrity or availability impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
4Description PRE-NVD
AnalysisAI
Apache JSPWiki versions up to and including 2.12.3 expose sensitive application internals through debug messages returned in HTTP responses, classified under CWE-1295 (Debug Messages Revealing Unnecessary Information). The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates any unauthenticated remote user can trigger disclosure of high-confidentiality data - potentially including session tokens, internal paths, configuration details, or stack traces - without requiring special privileges or user interaction. Despite the high CVSS score of 7.5, real-world exploitation probability is notably low at 0.17% EPSS (7th percentile), and no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Technical ContextAI
Apache JSPWiki is an open-source wiki engine built on Java/JSP, maintained under the Apache Software Foundation umbrella. CWE-1295 (Improper Output Neutralization for Logs / Debug Messages Revealing Unnecessary Information) describes a class of flaws where the application emits diagnostic or debug content - stack traces, internal variable states, configuration values, or credential fragments - through channels accessible to end users, such as HTTP error responses or verbose headers. CPE data per EUVD lists affected versions as Apache JSPWiki from 0 up to (but not including) the fixed version, covering all releases through 2.12.3. The root cause is insufficient sanitization or conditional gating of debug output, meaning sensitive runtime state is surfaced to network clients without authentication.
RemediationAI
The primary remediation is upgrading Apache JSPWiki to version 2.12.4, which the vendor confirms resolves this issue per the official advisory at https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2026-28811. Where immediate upgrade is not feasible, operators should review JSPWiki's logging and error-handling configuration to disable or restrict debug-level output in production deployments - specifically ensuring debug mode is not enabled in jspwiki.properties or the underlying servlet container. Additionally, placing the JSPWiki instance behind a reverse proxy configured to strip or sanitize verbose server error responses can reduce exposure; however, this is a compensating control, not a fix, as it does not eliminate the underlying debug data generation. Network-level access restriction to trusted IP ranges reduces the attack surface for unauthenticated exploitation. All controls should be treated as temporary until the 2.12.4 upgrade is applied.
Privilege escalation via user impersonation affects Apache JSPWiki through version 2.12.3, where the UserManager compone
Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a
Cross-site request forgery via JSON Hijacking affects Apache JSPWiki through version 2.12.3, letting a remote attacker w
A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3,
Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Rated high sever
Unauthenticated Wiki Markup rendering in Apache JSPWiki up to 2.12.3 exposes sensitive data stored in internal JSPWiki v
A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.
Cross-site scripting in Apache JSPWiki's Markdown renderer error-handling path allows attackers with page-editing access
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3,
XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser
A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the
A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow t
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today