CVE-2026-28813
Awaiting Analysis Awaiting Analysis - Queue

JSON Hijacking CSRF Vulnerability in Apache JSPWiki

Publication date: 2026-07-30

Last updated on: 2026-07-31

Assigner: Apache Software Foundation

Description
Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities. Users are recommended to upgrade to version 2.12.4, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-28813
EUVD
EUVD-2026-51180

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache jspwiki to 2.12.3 (inc)
apache jspwiki 2.12.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Apache JSPWiki versions up to 2.12.3 are vulnerable to JSON Hijacking, which allows attackers to perform Cross-Site Request Forgery (CSRF) attacks. This occurs because the application does not properly protect JSON responses, enabling unauthorized actions on behalf of authenticated users.

Detection Guidance

To detect this vulnerability, check the Apache JSPWiki version installed on your system. If it is 2.12.3 or lower, the system is vulnerable. Run: java -jar JSPWiki.jar --version or check the version in the web interface or logs.

Impact Analysis

This vulnerability could allow attackers to trick users into executing unwanted actions on the JSPWiki platform, such as modifying content, deleting pages, or changing user settings. It may lead to unauthorized data access or manipulation if the attacker gains control of a user's session.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations using affected JSPWiki versions may face compliance risks due to insufficient protection against CSRF attacks.

Mitigation Strategies

Upgrade Apache JSPWiki to version 2.12.4 or later immediately. Download the latest version from the official Apache JSPWiki website and follow the upgrade instructions provided in the release notes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-28813. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart