Vulnerability record · CVE-2022-28731 · published 4 August 2022
CVE-2022-28731: Apache JSPWiki CSRF in UserPreferences.jsp allows email change
Apache · Jspwiki
Apache JSPWiki before 2.11.3 is vulnerable to cross-site request forgery on UserPreferences.jsp. A crafted request can change the email address tied to a victim's account, and the attacker can then trigger a password reset from the login page to take over the account. The flaw is an integrity issue rather than direct code execution.
Description
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Automated analysis
high priorityAccount takeover is achievable through email change plus password reset, and EPSS is very high, though exploitation requires user interaction and no KEV listing exists.
What it is
Apache JSPWiki before 2.11.3 is vulnerable to cross-site request forgery on UserPreferences.jsp. A crafted request can change the email address tied to a victim's account, and the attacker can then trigger a password reset from the login page to take over the account. The flaw is an integrity issue rather than direct code execution.
Impact
An attacker can change the victim's account email and then request a password reset, gaining control of the account. No confidentiality loss is scored, but integrity impact is high.
Attack surface
Reachable over the network through a crafted request to UserPreferences.jsp; the CVSS vector shows no privileges required but user interaction is required, meaning the victim must be induced to submit the request while authenticated.
Exploitation
Not listed in CISA KEV and no ransomware usage documented. EPSS is high at 0.56928 (99th percentile), but the only references are vendor advisories tagged Not Applicable, so no public exploit code is confirmed by this record.
What to do
- Upgrade Apache JSPWiki to 2.11.3 or later, which is the fixed version named in the advisory.
- Add or verify anti-CSRF tokens on state-changing endpoints such as UserPreferences.jsp.
- Set session cookies with SameSite=Lax or Strict to reduce cross-site request forgery exposure.
- Require re-authentication or confirmation before changing account email addresses.
- Monitor and rate-limit password reset requests tied to recently changed email addresses.
Detection
- Alert on email-change requests to UserPreferences.jsp that lack a valid CSRF token or have an unexpected Referer.
- Correlate email-change events with immediate password reset requests from the same account or IP.
- Review web logs for POST requests to UserPreferences.jsp originating from external or unusual referrers.
- Track password reset flows that follow recent profile changes for the same user.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732 | Not ApplicableVendor Advisory |
| https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732 | Not ApplicableVendor Advisory |
Track CVE-2022-28731 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-28731), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
