CVE-2022-24947: Cross Site Request Forgery in Apache JSPWiki

org.apache.jspwiki:jspwiki-main Updated 02 Oct 2025

Summary

26/02/2022

Disclosed on

CVE-2022-24947

CVE

Yes i

Fix available

High

Severity

8.8

CVSS Score

CVE-2022-24947: Cross Site Request Forgery in Apache JSPWiki. Affects org.apache.jspwiki:jspwiki-main versions < 2.11.2. Fixed in 2.11.2. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Apache JSPWiki is an open-source wiki engine written in Java. It provides a platform for collaborative content creation and management. The JSPWiki user preferences form allows users to customize their settings and preferences. However, a vulnerability in this form makes it susceptible to Cross Site Request Forgery (CSRF) attacks. This means that an attacker can trick a user into unknowingly performing actions on their behalf, potentially leading to account takeover.

Vulnerability Detail

The vulnerability in Apache JSPWiki's user preferences form allows an attacker to craft malicious requests that can be executed by authenticated users. By tricking a user into clicking on a specially crafted link or visiting a malicious website, the attacker can perform actions on behalf of the user without their consent. This can lead to various security risks, including account takeover, unauthorized access to sensitive information, and potential manipulation of user preferences.

How To Fix

Minimum fixed version

2.11.2

This is the first release that contains the fix.

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

There is no known workaround for this vulnerability. Upgrading to the patched version is the recommended solution.

Conclusion

The Cross Site Request Forgery (CSRF) vulnerability in Apache JSPWiki's user preferences form can lead to account takeover and unauthorized access to sensitive information. It is crucial for Apache JSPWiki users to upgrade to version 2.11.2 or later to mitigate this vulnerability. For further support and assistance with vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for org.apache.jspwiki:jspwiki-main →

FAQ

What is Apache JSPWiki?

Apache JSPWiki is an open-source wiki engine written in Java. It allows users to collaboratively create and manage content.

What is Cross Site Request Forgery (CSRF)?

Cross Site Request Forgery (CSRF) is an attack that tricks a user into unknowingly performing actions on a website without their consent. In the case of Apache JSPWiki, this vulnerability allows an attacker to perform actions on behalf of an authenticated user.