The vulnerability allows an unauthenticated attacker to trigger the Wiki markup rendering engine in Apache JSPWiki, exposing JSPWiki variables that can contain configuration or authentication data. This leads to information disclosure of sensitive data such as database credentials or external resource URLs, potentially aiding attackers in further compromise. The weakness stems from a lack of authentication before rendering, corresponding to CWE-306.

Any installation of Apache JSPWiki version 2.12.3 or earlier is vulnerable. The issue is corrected in releases 2.12.4 and 3.0.0, and those newer versions should be used to avoid exposure.

Although the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, the lack of authentication makes exploitation trivial for anyone who can reach the wiki. A web request that initiates the rendering process will reveal the sensitive variables. Consequently, any publicly exposed or weakly protected JSPWiki instance faces a high risk of data leakage, regardless of network perimeter protections.