PT-2022-23185 · Unknown · Xwiki Platform

Michael Hamann · Published 2022-09-08 · Updated 2022-09-16 · CVE-2022-36095

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 13.10.5 and 14.3

Description The issue allows for a Cross-Site Request Forgery (CSRF) attack, enabling the addition or removal of tags on XWiki pages.

Recommendations For versions prior to 13.10.5, update to version 13.10.5 or later. For versions prior to 14.3, update to version 14.3 or later. As a temporary workaround, consider locally modifying the documentTags.vm template in the filesystem to apply the exposed changes.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-36095

GHSA-FXWR-4VQ9-9VHJ

Affected Products

Xwiki Platform

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36095.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-fxwr-4vq9-9vhj · Patch
• https://github.com/xwiki/xwiki-platform/commit/7ca56e40cf79a468cea54d3480b6b403f259f9ae · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-36095 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36095 · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-19550 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fxwr-4vq9-9vhj · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cvenotify/35908 · Telegram Post
• https://t.me/cibsecurity/49483 · Telegram Post