CVE-2022-28730: Apache JSPWiki AJAXPreview.jsp reflected XSS via Denounce plugin

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw is a network-reachable XSS with a very high EPSS score, though it requires user interaction and no KEV listing or confirmed public exploit is present.

What it is

Apache JSPWiki's AJAXPreview.jsp renders user-supplied URLs through the Denounce plugin without adequate sanitisation, allowing reflected cross-site scripting. The flaw is an incomplete fix for CVE-2021-40369, so sites that applied that earlier patch remain exposed. It matters because an attacker can run script in a victim's browser session and read sensitive information from the page.

Impact

An attacker can execute JavaScript in a victim's browser in the context of the JSPWiki site, exposing session data and other sensitive information visible to that user. The CVSS scope change (S:C) means the impact can extend beyond the vulnerable component.

Attack surface

Reached over the network through a crafted request to AJAXPreview.jsp; the vector shows no privileges required (PR:N) but user interaction is required (UI:R), so a victim must follow a crafted link or otherwise trigger the request.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.854, 99.7th percentile), indicating substantial predicted exploitation activity. The only references are vendor advisories, so no public exploit code is confirmed by this record.

What to do

• Upgrade Apache JSPWiki to 2.11.3 or later, which the vendor states resolves the incomplete Denounce plugin fix.
• If immediate upgrade is not possible, restrict or disable the Denounce plugin and review any custom URL-rendering paths.
• Apply output encoding and URL sanitisation to all user-supplied input rendered by JSPWiki plugins.
• Deploy a WAF rule or CSP that blocks inline script execution on JSPWiki pages as a compensating control.

Detection

• Inspect web logs for requests to AJAXPreview.jsp containing script tags, event handlers, or javascript: URIs in parameters.
• Monitor for reflected payloads in HTTP responses from JSPWiki endpoints and alert on unencoded script content.
• Review browser or proxy telemetry for outbound requests or cookie access originating from JSPWiki pages shortly after a crafted link is opened.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.