Executive brief
Apache JSPWiki, a popular wiki engine, is vulnerable to a security flaw that could allow an attacker to trick a logged-in user into performing unintended actions. By exploiting how the system handles data in the background, an attacker could potentially modify wiki content or settings without the user's knowledge. Organizations using this software should upgrade to version 2.12.4 to protect their wiki data and user sessions.
Technical details
Apache JSPWiki versions up to 2.12.3 are vulnerable to JSON Hijacking, a specific form of Cross-Site Request Forgery (CSRF). The vulnerability arises when the application returns sensitive data in a JSON format that can be intercepted by a malicious third-party site if a user is authenticated. An attacker can leverage this to bypass CSRF protections or extract data from the wiki environment. The issue is addressed in version 2.12.4 by implementing stricter controls on JSON responses and request validation. No specific authentication level is required beyond the victim being logged into the vulnerable JSPWiki instance.
Affected products
- Apache Software Foundation JSPWiki up to 2.12.3
Timeline
- 2026-07-30: disclosed: Initial disclosure by Apache Software Foundation
- 2026-07-30: patched: Version 2.12.4 released to address the issue