CVE-2026-28813

Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities. Users are recommended to upgrade to version 2.12.4, which fixes this issue.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/56440mymwkxt1hf3j8hjpo41yco7gotv	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/07/30/16	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:jspwiki:*:*:*:*:*:*:*:*

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Apache JSPWiki, hasta la versión 2.12.3, es vulnerable a secuestro de JSON, lo que lleva a vulnerabilidades CSRF. Se recomienda a los usuarios actualizar a la versión 2.12.4, que soluciona este problema.

Information

Published : 2026-07-30 16:17

Updated : 2026-10-23 22:10

NVD link : CVE-2026-28813

Mitre link : CVE-2026-28813

CVE.ORG link : CVE-2026-28813

JSON object : View

Products Affected

apache

jspwiki

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2026-28813", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28813", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-31T11:34:29.515111Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache JSPWiki", "versions": [{"status": "affected", "version": "0", "lessThan": "2.12.4", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-30T16:17:11.070", "references": [{"url": "https://lists.apache.org/thread/56440mymwkxt1hf3j8hjpo41yco7gotv", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/30/16", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities.\nUsers are recommended to upgrade to version 2.12.4, which fixes this issue."}, {"lang": "es", "value": "Apache JSPWiki, hasta la versi\u00f3n 2.12.3, es vulnerable a secuestro de JSON, lo que lleva a vulnerabilidades CSRF. Se recomienda a los usuarios actualizar a la versi\u00f3n 2.12.4, que soluciona este problema."}], "lastModified": "2026-10-23T22:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:jspwiki:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8891E7DC-16A4-45E0-9683-0E488593FB1F", "versionEndExcluding": "2.12.4"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}