EUVD-2026-51180
GHSA-59wm-6vhj-9fgr
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network CSRF needing no attacker auth (PR:N) but victim interaction (UI:R); JSON hijacking yields limited confidentiality (C:L), forged actions give integrity impact (I:H), no availability effect (A:N).
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
6Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Cross-site request forgery via JSON Hijacking affects Apache JSPWiki through version 2.12.3, letting a remote attacker who lures an authenticated user to a malicious page read sensitive JSON responses and force state-changing wiki actions in the victim's session. The flaw (CWE-352) is fixed in 2.12.4 and carries a vendor CVSS of 8.8, though exploitation requires user interaction; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
Apache JSPWiki is a Java/JSP-based, feature-rich wiki engine built on the Servlet API. The issue is a JSON Hijacking weakness: JSON-returning endpoints (e.g. AJAX/search or page-data responses) can be requested cross-origin and their contents inferred or replayed, and because those endpoints do not adequately validate request origin or anti-CSRF tokens they are also abusable for CSRF. The root cause class is CWE-352 (Cross-Site Request Forgery), where the server trusts the ambient browser session (cookies) without a per-request unforgeable token, allowing a third-party page to drive authenticated requests.
RemediationAI
Vendor-released patch: upgrade to Apache JSPWiki 2.12.4, which fixes the issue and is the primary recommended action per the Apache advisory (https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2026-28813 and the announcement thread https://lists.apache.org/thread/56440mymwkxt1hf3j8hjpo41yco7gotv). Until upgrading, reduce exposure by restricting the wiki to trusted networks or requiring VPN access, and enforce SameSite=Strict/Lax on the session cookie to blunt cross-site request forgery (side effect: may break legitimate cross-site links into authenticated wiki pages). Deploying a reverse-proxy or WAF rule that rejects state-changing requests lacking a matching Origin/Referer header can serve as an interim compensating control, though it can produce false positives for clients that strip those headers.
Privilege escalation via user impersonation affects Apache JSPWiki through version 2.12.3, where the UserManager compone
Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a
A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3,
Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Rated high sever
Unauthenticated Wiki Markup rendering in Apache JSPWiki up to 2.12.3 exposes sensitive data stored in internal JSPWiki v
Apache JSPWiki versions up to and including 2.12.3 expose sensitive application internals through debug messages returne
A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.
Cross-site scripting in Apache JSPWiki's Markdown renderer error-handling path allows attackers with page-editing access
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3,
XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser
A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the
A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow t
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today