CVE-2022-28730
Published: 04 August 2022
Summary
CVE-2022-28730 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Apache Jspwiki. Its CVSS base score is 6.1 (Medium).
Operationally, ranked in the top 6.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-28730 is a cross-site scripting vulnerability (CWE-79) in Apache JSPWiki that can be triggered by a carefully crafted request to AJAXPreview.jsp. The flaw stems from incomplete remediation of CVE-2021-40369 in the Denounce plugin, which continues to render attacker-supplied URLs without adequate sanitization, allowing script execution in the victim's browser.
An unauthenticated remote attacker can exploit the issue by supplying malicious input through the Denounce plugin. Successful exploitation enables execution of JavaScript in the context of the victim's session, potentially disclosing sensitive information from the browser.
Advisories recommend that Apache JSPWiki users upgrade to version 2.11.3 or later to address the vulnerability. The referenced Apache JSPWiki pages document the related CVE-2022-28732 and the required remediation steps.
The EPSS score has remained flat at its recorded peak of 0.1134 with no material upward trajectory after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-6557
Vulnerability details
A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This vulnerability leverages CVE-2021-40369, where the…
more
Denounce plugin dangerously renders user-supplied URLs. Upon re-testing CVE-2021-40369, it appears that the patch was incomplete as it was still possible to insert malicious input via the Denounce plugin. Apache JSPWiki users should upgrade to 2.11.3 or later.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.