The vulnerability is a JSON Hijacking flaw present in Apache JSPWiki up to version 2.12.3. JSON hijacking allows a malicious site to read JSON data returned by the Wiki, thereby enabling cross‑site request forgery (CSRF). The flaw arises because legitimate JSON responses are not properly protected, allowing a browser to expose sensitive data or trigger state‑changing requests without user consent. The resulting impact is that an attacker can modify wiki content or perform privileged operations if the victim has previously authenticated.

Apache Software Foundation: Apache JSPWiki versions 2.12.3 and earlier are affected.

The flaw can be triggered by any user who access the vulnerable JSON endpoint, making it readily exploitable in a typical web environment. The EPSS score is < 1%, and the vulnerability is not listed in CISA's KEV catalog, so exploitation likelihood remains uncertain but the potential for CSRF remains high. Official guidance recommends upgrading to version 2.12.4, which removes the JSON response vulnerability.