Skip to content
Fencer Intel
medium 6.1

CVE-2022-28730 json

Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp

published 4y ago modified 4mo ago also GHSA-ggjq-8c4c-68r5 , EUVD-2022-6557

cvss
6.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
86.2%
EPSS 86.2% chance of exploitation in 30 days, percentile 99.7%
public exploits
0
none known

Summary

A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This vulnerability leverages CVE-2021-40369, where the Denounce plugin dangerously renders user-supplied URLs. Upon re-testing CVE-2021-40369, it appears that the patch was incomplete as it was still possible to insert malicious input via the Denounce plugin. Apache JSPWiki users should upgrade to 2.11.3 or later.

Patch / fix

  • maven org.apache.jspwiki:jspwiki-main 2.11.3
  • apache jspwiki 2.11.3

Is CVE-2022-28730 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

86.16% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
GitHub 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
maven org.apache.jspwiki:jspwiki-main
<2.11.3
2.11.3

Affected products

  • Apache Software Foundation Apache JSPWiki

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.