PT-2022-23186 · Unknown · Xwiki Platform

Michael Hamann · Published 2022-09-08 · Updated 2022-09-16 · CVE-2022-36096

Positive Technologies (AI Summary)

CVSS v3.1

8.9

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 13.10.6 and 14.3

Description The XWiki Platform Index UI allows storing JavaScript that will be executed by anyone viewing the deleted attachments index with an attachment containing JavaScript in its name. This issue has been patched in XWiki 13.10.6 and 14.3. For example, an attachment with a name like ><img src=1 onerror=alert(1)>.jpg will execute the alert.

Recommendations For versions prior to 13.10.6 and 14.3, update to version 13.10.6 or 14.3 to resolve the issue. As a temporary workaround, modify the vulnerability by editing the wiki page XWiki.DeletedAttachments with the object editor, open the JavaScriptExtension object and apply on the content the changes that can be found on the fix commit.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

CWE-80

Related Identifiers

CVE-2022-36096

GHSA-GJMQ-X5X7-WC36

Affected Products

Xwiki Platform

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36096.json · Exploit
• https://github.com/xwiki/xwiki-platform/commit/6705b0cd0289d1c90ed354bd4ecc1508c4b25745 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-36096 · Security Note
• https://osv.dev/vulnerability/GHSA-gjmq-x5x7-wc36 · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-19613 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36096 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gjmq-x5x7-wc36 · Note
• https://t.me/cvenotify/35907 · Telegram Post
• https://t.me/cibsecurity/49482 · Telegram Post