CVE-2022-34158: User Group Privilege Escalation

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-08-04 · updated 2026-06-17
Weakness: CWE-352

Description

A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege escalation of the attacker's account. Further examination of this issue established that it could also be used to modify the email associated with the attacked account, and then a reset password request from the login page.

Affected products

Apache Software Foundation Apache JSPWiki: before 2.11.3 — fixed in 2.11.3

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache JSPWiki 2.11.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-34158 or the next vulnerability affects your stack