The flaw permits a malicious actor to receive detailed debug messages when an error occurs within the servlet environment, exposing stack traces and internal configuration data. The vulnerability arises from insufficient sanitization of exception information before it is rendered to the user, an issue mapped to CWE‑1295. An attacker can gather details that may aid in enumeration or subsequent exploits, compromising the confidentiality of the application’s internal state without providing direct code execution or denial of service.

The defect affects all releases of Apache JSPWiki up through version 2.12.3. The upstream maintainers recommend upgrading to 2.12.4, which includes the required patch. The software is distributed under the Apache Software Foundation’s umbrella.

The CVSS score of 7.5 indicates a high severity yet the EPSS score is <1%, suggesting very low likelihood of automated exploitation. The vulnerability is a data‑exposure flaw that helps attackers discover internal information and credentials. It can be triggered by causing an error that leads to a detailed debug message being displayed to a user, which can happen when error pages are publicly accessible. Thus, the primary risk involves confidentiality leakage, with a moderate likelihood for environments that expose error pages to unauthenticated parties. The vulnerability is not listed in the CISA KEV catalog.