PT-2022-23188 · Xwiki · Xwiki Platform

Michael Hamann · Published 2022-09-08 · Updated 2022-09-16 · CVE-2022-36098

Positive Technologies (AI Summary)

CVSS v3.1

8.9

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 12.5-rc-1 through 13.10.5 XWiki Platform versions 12.5-rc-1 through 14.3

Description The XWiki Platform Mentions UI allows storing Javascript or groovy scripts in a mention, macro anchor, or reference field. The stored code is executed by anyone visiting the page with the mention. This issue has been patched on XWiki 14.4 and 13.10.6. As a workaround, one may update XWiki.Mentions.MentionsMacro and edit the Macro code field of the XWiki.WikiMacroClass XObject.

Recommendations For XWiki Platform versions 12.5-rc-1 through 13.10.5, update to version 13.10.6. For XWiki Platform versions 12.5-rc-1 through 14.3, update to version 14.4. As a temporary workaround, consider updating XWiki.Mentions.MentionsMacro and editing the Macro code field of the XWiki.WikiMacroClass XObject to fix the vulnerability. Restrict access to the XWiki.Mentions.MentionsMacro macro to minimize the risk of exploitation. Avoid using the reference field in the affected mention macro until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-36098

GHSA-C5V8-2Q4R-5W9V

Affected Products

Xwiki Platform

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36098.json · Exploit
• 🔥 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5v8-2q4r-5w9v · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-19752 · Exploit
• https://github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459#diff-4fe22885f772e47d3561a05348f73921669ec12d4413b220383b73c7ae484bc4R608-R610 · Patch
• https://github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-36098 · Security Note
• https://osv.dev/vulnerability/GHSA-c5v8-2q4r-5w9v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36098 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cibsecurity/49479 · Telegram Post
• https://t.me/cvenotify/35905 · Telegram Post