CRITICAL🇵🇱 Wersja polska

CVE-2026-28812

CVSS 9.8pub. 2026-07-30upd. 2026-08-05

UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges. Users are recommended to upgrade to version 2.12.4 or newer which fixes this issue.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Apache Jspwiki

    APP
    Apache
    < 2.12.4
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
LPE
CWE
References

Related vulnerabilities

CVE-2021-44140CRITICAL9.1PL ✓same product

Apache JSPWiki — zdalne usuwanie plików przez spreparowane żądanie HTTP

CVE-2026-28814HIGH7.5PL ✓same product

Apache JSPWiki — nieautoryzowane renderowanie Wiki Markup ujawnia dane

CVE-2026-28811HIGH7.5PL ✓same product

Apache JSPWiki: ujawnianie informacji przez komunikaty debugowania

CVE-2026-28813HIGH8.8PL ✓same product

Apache JSPWiki – JSON Hijacking prowadzący do podatności CSRF

CVE-2025-24853HIGH7.5same product

A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the a...