{"id":"CVE-2026-28814","state":"PUBLISHED","title":"Apache JSPWiki: Pre-Authentication Arbitrary Wiki Markup Rendering","description":"Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables.\nUsers are recommended to upgrade to version 2.12.4 or 3.0.0, which fixes this issue.","publishedAt":"2026-07-30T15:55:28.034Z","updatedAt":"2026-07-31T17:55:59.734Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"CISA-ADP"},"assigner":"apache","products":["Apache Software Foundation Apache JSPWiki"],"affected":[{"vendor":"Apache Software Foundation","product":"Apache JSPWiki","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.12.4","versionType":"semver"}]}],"references":["https://lists.apache.org/thread/8vv0311bvrrqxsyn913pcwf7pctyk52w","http://www.openwall.com/lists/oss-security/2026/07/30/17"],"weaknesses":["CWE-306"],"ingestedAt":"2026-10-29T20:11:31.369Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/28xxx/CVE-2026-28814.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-28814","state":"PUBLISHED","datePublished":"2026-07-30T15:55:28.034Z","dateUpdated":"2026-07-31T17:55:59.734Z","assignerShortName":"apache","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateReserved":"2026-03-03T15:02:10.764Z"},"containers":{"cna":{"title":"Apache JSPWiki: Pre-Authentication Arbitrary Wiki Markup Rendering","descriptions":[{"lang":"en","value":"Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables.\nUsers are recommended to upgrade to version 2.12.4 or 3.0.0, which fixes this issue."}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache JSPWiki","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.12.4","versionType":"semver"}]}],"references":[{"url":"https://lists.apache.org/thread/8vv0311bvrrqxsyn913pcwf7pctyk52w","tags":["vendor-advisory"]}],"metrics":[{"other":{"content":{"text":"critical"},"type":"Textual description of severity"}}],"problemTypes":[{"descriptions":[{"description":"Arbitrary Wiki Markup rendering due to lack of authentication","lang":"en"}]}],"providerMetadata":{"shortName":"apache","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateUpdated":"2026-07-30T15:55:28.034Z"},"credits":[{"lang":"en","type":"finder","value":"Miguel Regala (Fisher) - Hadrian.io"}],"source":{"defect":["JSPWIKI-1270"],"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/07/30/17"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2026-07-30T16:36:36.963Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-07-31T17:55:52.115268Z","id":"CVE-2026-28814","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","type":"CWE","lang":"en","description":"CWE-306 Missing Authentication for Critical Function"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-31T17:55:59.734Z"}}]}}}