CVE-2022-28731

{"id": "CVE-2022-28731", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2022-08-04T07:15:07.557", "references": [{"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732", "tags": ["Not Applicable", "Vendor Advisory"], "source": "security@apache.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page."}, {"lang": "es", "value": "Una petici\u00f3n cuidadosamente dise\u00f1ada en el archivo UserPreferences.jsp podr\u00eda desencadenar una vulnerabilidad de tipo CSRF en Apache JSPWiki versiones 2.11.3, que podr\u00eda permitir al atacante modificar el correo electr\u00f3nico asociado a la cuenta atacada, y luego una petici\u00f3n de restablecimiento de contrase\u00f1a desde la p\u00e1gina de inicio de sesi\u00f3n"}], "lastModified": "2022-08-10T15:52:48.027", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:jspwiki:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64A3E769-A3E7-4648-8792-5138BD591C1F", "versionEndExcluding": "2.11.3"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}