CVE-2022-24947 - Vulnerability Details - OpenCVE

Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Apache	Jspwiki

Configuration 1 [-]

cpe:2.3:a:apache:jspwiki:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2022/02/25/1
https://lists.apache.org/thread/txrgykjkpt80t57kzpbjo8kfrv8ss02c

History

No history.

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2022-02-25T08:30:18

Updated: 2024-08-03T04:29:01.578Z

Reserved: 2022-02-10T00:00:00

Link: CVE-2022-24947

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-02-25T09:15:07.007

Modified: 2024-11-21T06:51:26.323

Link: CVE-2022-24947

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Apache JSPWiki", "vendor": "Apache Software Foundation", "versions": [{"status": "affected", "version": "Apache JSPWiki up to 2.11.1 "}]}], "credits": [{"lang": "en", "value": "This issue was discovered initially by Cristian Borlovan from Ounce Labs Security (ref. JSPWIKI-79), and later on and independently from this by Paulos Yibelo, from Octagon Networks. "}], "descriptions": [{"lang": "en", "value": "Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later."}], "problemTypes": [{"descriptions": [{"description": "CSRF Account Takeover", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-02-25T15:06:13", "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://lists.apache.org/thread/txrgykjkpt80t57kzpbjo8kfrv8ss02c"}, {"name": "[oss-security] 20220225 [CVE-2022-24947] Apache JSPWiki CSRF Account Takeover", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2022/02/25/1"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache JSPWiki CSRF Account Takeover", "workarounds": [{"lang": "en", "value": "Installations >= 2.7.0 can also enable user management workflows' manual approval to mitigate the issue."}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@apache.org", "ID": "CVE-2022-24947", "STATE": "PUBLIC", "TITLE": "Apache JSPWiki CSRF Account Takeover"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Apache JSPWiki", "version": {"version_data": [{"version_value": "Apache JSPWiki up to 2.11.1 "}]}}]}, "vendor_name": "Apache Software Foundation"}]}}, "credit": [{"lang": "eng", "value": "This issue was discovered initially by Cristian Borlovan from Ounce Labs Security (ref. JSPWIKI-79), and later on and independently from this by Paulos Yibelo, from Octagon Networks. "}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": [{}], "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CSRF Account Takeover"}]}]}, "references": {"reference_data": [{"name": "https://lists.apache.org/thread/txrgykjkpt80t57kzpbjo8kfrv8ss02c", "refsource": "MISC", "url": "https://lists.apache.org/thread/txrgykjkpt80t57kzpbjo8kfrv8ss02c"}, {"name": "[oss-security] 20220225 [CVE-2022-24947] Apache JSPWiki CSRF Account Takeover", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2022/02/25/1"}]}, "source": {"discovery": "UNKNOWN"}, "work_around": [{"lang": "en", "value": "Installations >= 2.7.0 can also enable user management workflows' manual approval to mitigate the issue."}]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T04:29:01.578Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://lists.apache.org/thread/txrgykjkpt80t57kzpbjo8kfrv8ss02c"}, {"name": "[oss-security] 20220225 [CVE-2022-24947] Apache JSPWiki CSRF Account Takeover", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2022/02/25/1"}]}]}, "cveMetadata": {"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "cveId": "CVE-2022-24947", "datePublished": "2022-02-25T08:30:18", "dateReserved": "2022-02-10T00:00:00", "dateUpdated": "2024-08-03T04:29:01.578Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:jspwiki:*:*:*:*:*:*:*:*", "matchCriteriaId": "300AE80B-D0D2-43AA-973A-2589F59C796D", "versionEndExcluding": "2.11.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later."}, {"lang": "es", "value": "El formulario de preferencias de usuario de Apache JSPWiki es vulnerable a ataques de tipo CSRF, que pueden conllevar a una toma de posesi\u00f3n de la cuenta. Los usuarios de Apache JSPWiki deber\u00edan actualizar a versi\u00f3n 2.11.2 o posterior.\n"}], "id": "CVE-2022-24947", "lastModified": "2024-11-21T06:51:26.323", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-02-25T09:15:07.007", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Mitigation", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/02/25/1"}, {"source": "security@apache.org", "tags": ["Mailing List", "Mitigation", "Vendor Advisory"], "url": "https://lists.apache.org/thread/txrgykjkpt80t57kzpbjo8kfrv8ss02c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Mitigation", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/02/25/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Mitigation", "Vendor Advisory"], "url": "https://lists.apache.org/thread/txrgykjkpt80t57kzpbjo8kfrv8ss02c"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}