title: Apache JSPWiki CSRF Account Takeover
description: Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later.
problem types: CSRF Account Takeover
affected:
{
product: Apache JSPWiki
vendor: Apache Software Foundation
versions:
status: affected, version: Apache JSPWiki up to 2.11.1
}
workarounds: Installations >= 2.7.0 can also enable user management workflows' manual approval to mitigate the issue.