Lucene search

GitHub_MCVE-2022-36096

HistorySep 08, 2022 - 9:15 p.m.

CVE-2022-36096

2022-09-0821:15:07

CWE-80

CWE-79

GitHub_M

web.nvd.nist.gov

xwiki

platform index ui

javascript

security vulnerability

cve-2022-36096

nvd

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.002

Percentile

60.7%

JSON

The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wiki platform. Prior to versions 13.10.6 and 14.3, it’s possible to store JavaScript which will be executed by anyone viewing the deleted attachments index with an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3. As a workaround, modify fix the vulnerability by editing the wiki page XWiki.DeletedAttachments with the object editor, open the JavaScriptExtension object and apply on the content the changes that can be found on the fix commit.

Affected configurations

Nvd

Vulners

Node

xwikixwikiRange2.3–13.10.6

xwikixwikiRange14.0–14.3

xwikixwikiMatch2.2milestone1

VendorProductVersionCPE
xwikixwiki*cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
xwikixwiki2.2cpe:2.3:a:xwiki:xwiki:2.2:milestone1:*:*:*:*:*:*

Vendor	Product	Version	CPE
xwiki	xwiki	*	cpe:2.3:a:xwiki:xwiki::::::::
xwiki	xwiki	2.2	cpe:2.3:a:xwiki:xwiki:2.2:milestone1::::::

CNA Affected

[
  {
    "product": "xwiki-platform",
    "vendor": "xwiki",
    "versions": [
      {
        "status": "affected",
        "version": ">= 2.2-milestone-1, < 13.10.6"
      },
      {
        "status": "affected",
        "version": ">= 14.0, < 14.3"
      }
    ]
  }
]

References

github.com/xwiki/xwiki-platform/commit/6705b0cd0289d1c90ed354bd4ecc1508c4b25745

github.com/xwiki/xwiki-platform/security/advisories/GHSA-gjmq-x5x7-wc36

jira.xwiki.org/browse/XWIKI-19613

Social References

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.002

Percentile

60.7%

JSON

Related for CVE-2022-36096