HIGH🇵🇱 Wersja polska

CVE-2026-28814

CVSS 7.5pub. 2026-07-30upd. 2026-08-05

Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables. Users are recommended to upgrade to version 2.12.4 or 3.0.0, which fixes this issue.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

  • Apache Jspwiki

    APP
    Apache
    < 2.12.4
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-28812CRITICAL9.8PL ✓same product

Apache JSPWiki: Podszywanie się pod użytkownika przez brak kontroli w UserManager

CVE-2021-44140CRITICAL9.1PL ✓same product

Apache JSPWiki — zdalne usuwanie plików przez spreparowane żądanie HTTP

CVE-2026-28813HIGH8.8PL ✓same product

Apache JSPWiki – JSON Hijacking prowadzący do podatności CSRF

CVE-2026-28811HIGH7.5PL ✓same product

Apache JSPWiki: ujawnianie informacji przez komunikaty debugowania

CVE-2025-24853HIGH7.5same product

A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the a...