Threats affecting pkg:maven/org.apache.jspwiki/jspwiki

Apache JSPWiki versions up to 2.12.3 contain a cross-site scripting (XSS) vulnerability due to improper neutralization of script-related HTML tags when parsing markdown rendering errors. This flaw allows an attacker to execute JavaScript in the victim's browser, potentially exposing sensitive information. The issue is fixed in version 2.12.4.

CVE-2026-28814 is a high-severity vulnerability in Apache JSPWiki up to version 2.12.3 that allows arbitrary Wiki Markup rendering due to lack of authentication. This flaw enables an attacker to access sensitive data stored in JSPWiki variables without requiring any privileges. The issue is resolved in versions 2.12.4 and 3.0.0 by introducing proper authentication controls.

Apache JSPWiki versions prior to 2.12.4 are vulnerable to a Cross-Site Request Forgery (CSRF) issue related to JSON Hijacking. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. The issue is fixed in version 2.12.4.

UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges. Users are recommended to upgrade to version 2.12.4 or newer which fixes this issue.

Apache JSPWiki versions prior to 2.12.4 contain a vulnerability where debug messages reveal unnecessary information. This issue is addressed in version 2.12.4. The vulnerability has a high severity score of 7.5 and is identified as CWE-1295.