← Vulnerability feed

Vulnerability record · CVE-2022-27166 · published 4 August 2022

CVE-2022-27166: Apache JSPWiki XHRHtml2Markup.jsp reflected XSS

Apache · Jspwiki

Apache JSPWiki up to and including 2.11.2 does not properly sanitize a crafted request to XHRHtml2Markup.jsp, allowing reflected cross-site scripting. An attacker can run JavaScript in a victim's browser in the context of the JSPWiki site, which matters because it exposes session data and other sensitive information about the victim.

6.1 CVSS 3.1 Medium EPSS 85% · top 0.3% CWE-79 · Cross-site scripting
6.1CVSS 3.1 base score
85%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

A carefully crafted request on XHRHtml2Markup.jsp could trigger an XSS vulnerability on Apache JSPWiki up to and including 2.11.2, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityMedium CVSS (6.1) but very high EPSS (99.7th percentile) and a remotely reachable, unauthenticated reflected XSS in a widely deployed wiki make timely patching important.

What it is

Apache JSPWiki up to and including 2.11.2 does not properly sanitize a crafted request to XHRHtml2Markup.jsp, allowing reflected cross-site scripting. An attacker can run JavaScript in a victim's browser in the context of the JSPWiki site, which matters because it exposes session data and other sensitive information about the victim.

Impact

An attacker gains script execution in the victim's browser session on the JSPWiki origin, enabling theft of session cookies or other sensitive information and actions performed as the victim.

Attack surface

Reached over the network via a crafted request to XHRHtml2Markup.jsp; no authentication is required (PR:N), but the victim must be induced to trigger the request (UI:R), and scope is changed (S:C).

Exploitation

Not listed in CISA KEV and no public exploit references are provided, but EPSS is very high (0.85389, 99.7th percentile), indicating elevated likelihood of attempted exploitation.

What to do

  • Upgrade Apache JSPWiki to a version later than 2.11.2 that fixes this XSS; patch first.
  • If immediate upgrade is not possible, restrict or disable access to XHRHtml2Markup.jsp and apply input validation or output encoding for its parameters.
  • Deploy a WAF rule to block script payloads targeting XHRHtml2Markup.jsp.
  • Set session cookies HttpOnly and SameSite to limit theft via injected script.
  • Review JSPWiki exposure to untrusted networks and limit access to trusted users.

Detection

  • Inspect web server and JSPWiki logs for requests to XHRHtml2Markup.jsp containing script tags, event handlers or encoded JavaScript.
  • Alert on XHRHtml2Markup.jsp responses reflecting user-supplied input without encoding.
  • Monitor for anomalous outbound requests or cookie exfiltration following JSPWiki page views.
  • Correlate WAF XSS blocks on JSPWiki endpoints with subsequent suspicious session activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732 Vendor Advisory
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732 Vendor Advisory

Track CVE-2022-27166 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-28812Apache jspwiki authentication bypass by spoofing vulnerabilityUserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges. Users are recommende…EPSS 0.69%9.1CVE-2021-44140Apache jspwiki incorrect default permissions vulnerabilityRemote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http reques…EPSS 6.4%8.8CVE-2026-28813Apache jspwiki cross-site request forgery vulnerabilityApache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities. Users are recommended to upgrade to version 2.12.…EPSS 0.27%8.8CVE-2022-34158Apache jspwiki cross-site request forgery vulnerabilityA carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group pri…EPSS 1.2%8.8CVE-2022-24947Apache jspwiki cross-site request forgery vulnerabilityApache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2…EPSS 1.2%7.5CVE-2026-28814Apache jspwiki missing authentication for critical function vulnerabilityArbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWi…EPSS 0.66%7.5CVE-2026-28811Apache jspwiki vulnerabilityDebug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes this…EPSS 0.79%7.5CVE-2025-24853Apache jspwiki cross-site scripting vulnerabilityA carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the vic…EPSS 0.53%

Source: NIST National Vulnerability Database (record CVE-2022-27166), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.