---
id: 6152
title: "CVE-2022-24948: Apache JSPWiki preauth Stored XSS to ATO"
cve: CVE-2022-24948
source_domain: pwn.ai
source_url: "https://pwn.ai/blog/apache-jspwiki-preauth-xss-to-ato"
published_at: "2022-03-02T10:15:00Z"
tags: ["vulnerability-research", "account-takeover", "stored-xss", "jspwiki", "cve-2022-24948"]
phying_url: "https://phying.com/item/6152"
lang: en
---

# CVE-2022-24948: Apache JSPWiki preauth Stored XSS to ATO

## Summary

CVE-2022-24948: how a tricky stored XSS in JSPWiki's username field was exploited via a meta-tag focus trick that avoids colons, escalating pre-auth injection toward account takeover.

## Intelligence Metadata

- **Sources:** pwn.ai
- **CVE:** CVE-2022-24948
- **Published:** 2022-03-02T10:15:00Z
- **Original:** https://pwn.ai/blog/apache-jspwiki-preauth-xss-to-ato
- **Phying News:** https://phying.com/item/6152