CVE-2022-34158: Cross-Site Request Forgery (CSRF)

August 4, 2022 (updated August 10, 2022)

A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege escalation of the attacker’s account. Further examination of this issue established that it could also be used to modify the email associated with the attacked account, and then a reset password request from the login page.

References

jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-34158
nvd.nist.gov/vuln/detail/CVE-2022-34158

Code Behaviors & Features

Detect and mitigate CVE-2022-34158 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →