XWiki Platform 注入漏洞

🗓️ 23 Nov 2022 00:00:00Reported by China National Vulnerability Database of Information SecurityType

cnnvd

cnnvd🔗 www.cnnvd.org.cn

XWiki Platform code injection flaw due to improper macro escaping enabling Groovy, Python or Velocity.

Reporter	Title	Published	Views	Family All 13
CNVD	XWiki Platform Code Injection Vulnerability	25 Nov 202200:00	–	cnvd
CVE	CVE-2022-41934	23 Nov 202200:00	–	cve
Cvelist	CVE-2022-41934 Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-menu-ui	23 Nov 202200:00	–	cvelist
EUVD	EUVD-2022-7261	3 Oct 202520:07	–	euvd
Github Security Blog	Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-menu-ui	21 Nov 202222:37	–	github
NVD	CVE-2022-41934	23 Nov 202220:15	–	nvd
OpenVAS	XWiki < 13.10.8, 14.x < 14.4.3, 14.5.x < 14.6 Eval Injection Vulnerability (GHSA-6w8h-26xx-cf8q)	24 Nov 202200:00	–	openvas
OSV	CVE-2022-41934 Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-menu-ui	23 Nov 202200:00	–	osv
OSV	GHSA-6W8H-26XX-CF8Q Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-menu-ui	21 Nov 202222:37	–	osv
Prion	Design/Logic Flaw	23 Nov 202220:15	–	prion

Source	Link
github	www.github.com/xwiki/xwiki-platform/security/advisories/GHSA-6w8h-26xx-cf8q
github	www.github.com/xwiki/xwiki-platform/commit/59ccca24a8465a19f40c51d65fcc2c09c1edea16
jira	www.jira.xwiki.org/browse/XWIKI-19857
xwiki	www.xwiki.org/xwiki/bin/view/Documentation/UserGuide/Features/Imports
github	www.github.com/xwiki/xwiki-platform/commit/2fc20891e6c6b0ca05ee07e315e7f435e8919f8d
cxsecurity	www.cxsecurity.com/cveshow/CVE-2022-41934/

24 May 2026 00:00Current

7.9High risk

Vulners AI Score7.9

CVSS 3.18.8 - 9.9

EPSS0.23616

SSVC

code injection macro escaping XWiki Platform Groovy Python Velocity