Lucene search

[email protected]CVE-2022-36097

HistorySep 08, 2022 - 9:15 p.m.

CVE-2022-36097

2022-09-0821:15:08

CWE-80

CWE-79

[email protected]

web.nvd.nist.gov

223

xwiki

platform

attachment

javascript

nvd

security

vulnerability

patch

8.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

6.2 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.4%

JSON

XWiki Platform Attachment UI provides a macro to easily upload and select attachments for XWiki Platform, a generic wiki platform. Starting with version 14.0-rc-1 and prior to 14.4-rc-1, it’s possible to store JavaScript in an attachment name, which will be executed by anyone trying to move the corresponding attachment. This issue has been patched in XWiki 14.4-rc-1. As a workaround, one may copy moveStep1.vm to webapp/xwiki/templates/moveStep1.vm and replace vulnerable code with code from the patch.

Affected configurations

Vulners

NVD

Node

xwikixwikiRange14.0-rc-1–14.4-rc-1

VendorProductVersionCPE
xwikixwiki*cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
xwiki	xwiki	*	cpe:2.3:a:xwiki:xwiki::::::::

CNA Affected

[
  {
    "product": "xwiki-platform",
    "vendor": "xwiki",
    "versions": [
      {
        "status": "affected",
        "version": ">= 14.0-rc-1, < 14.4-rc-1"
      }
    ]
  }
]

References

github.com/xwiki/xwiki-platform/commit/fbc4bfbae4f6ce8109addb281de86a03acdb9277

github.com/xwiki/xwiki-platform/security/advisories/GHSA-9r9j-57rf-f6vj

jira.xwiki.org/browse/XWIKI-19667

raw.githubusercontent.com/xwiki/xwiki-platform/xwiki-platform-14.0-rc-1/xwiki-platform-core/xwiki-platform-attachment/xwiki-platform-attachment-api/src/main/resources/templates/attachment/moveStep1.vm