PT-2022-23184 · Xwiki · Xwiki Platform Web Parent Pom+1

Michael Hamann · Published 2022-09-08 · Updated 2022-09-16 · CVE-2022-36094

Positive Technologies (AI Summary)

CVSS v3.1

8.9

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions XWiki Platform Web Parent POM versions 1.0 through 13.10.5 XWiki Platform Web Parent POM versions 14.0-rc-1 through 14.3

Description The issue allows storing JavaScript that will be executed by anyone viewing the history of an attachment containing JavaScript in its name. For example, an attachment with a name like ><img src=1 onerror=alert(1)>.jpg will execute the alert. This issue has been patched in XWiki 13.10.6 and 14.3RC1.

Recommendations For versions prior to 13.10.6, update to version 13.10.6 or later. For versions prior to 14.3RC1, update to version 14.3RC1 or later. As a temporary workaround, consider replacing the viewattachrev.vm file with a patched version from the patch without updating XWiki.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

CWE-80

Related Identifiers

CVE-2022-36094

GHSA-MXF2-4R22-5HQ9

Affected Products

Xwiki

Xwiki Platform Web Parent Pom

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36094.json · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-19612 · Exploit
• https://github.com/xwiki/xwiki-platform/commit/047ce9fa4a7c13f3883438aaf54fc50f287a7e8e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-36094 · Security Note
• https://osv.dev/vulnerability/GHSA-mxf2-4r22-5hq9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36094 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mxf2-4r22-5hq9 · Note
• https://t.me/cibsecurity/49485 · Telegram Post