A high-severity information disclosure vulnerability in Apache JSPWiki allows unauthenticated attackers to access sensitive system data through debug messages.

The application incorrectly exposes debug information (CWE-1295), which can be accessed by an unauthenticated attacker over the network without requiring any user interaction.

The exposure of debug information can lead to the unauthorized disclosure of sensitive configuration details, internal path structures, or system state data. This information facilitates further reconnaissance, potentially leading to more targeted attacks against the infrastructure. With a CVSS score of 7.5, this vulnerability represents a significant risk to confidentiality.

Immediate Action: Upgrade the Apache JSPWiki installation to version 2.12.4 or later to resolve the debug message exposure.

Proactive Monitoring: Review web server and application access logs for unusual request patterns targeting debug or administrative endpoints.

Compensating Controls: Implement Web Application Firewall (WAF) rules to filter or block requests that attempt to trigger verbose error pages or debug outputs.

Public Exploit Available: No (exploit_available: false)

Given the ease of exploitability and the potential for sensitive data exposure, administrators should prioritize updating to version 2.12.4 immediately. While there is no current evidence of active exploitation, the accessibility of this vulnerability makes it a high-priority target for automated scanning tools. Ensure all production JSPWiki instances are patched and that development-level debugging features are disabled in public-facing environments.