CVE-2022-41931

2022-11-2320:15:10

CWE-95

[email protected]

web.nvd.nist.gov

xwiki

icon picker macro

eval injection

cve-2022-41931

security patch

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

9 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

62.3%

JSON

xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code (‘Eval Injection’). Any user with view rights on commonly accessible documents including the icon picker macro can execute arbitrary Groovy, Python or Velocity code in XWiki due to improper neutralization of the macro parameters of the icon picker macro. The problem has been patched in XWiki 13.10.7, 14.5 and 14.4.2. Workarounds: The patch can be manually applied by editing IconThemesCode.IconPickerMacro in the object editor. The whole document can also be replaced by the current version by importing the document from the XAR archive of a fixed version as the only changes to the document have been security fixes and small formatting changes.

Affected configurations

Vulners

NVD

Node

xwikixwikiRange6.4-milestone-2–13.10.7

xwikixwikiRange14.0.0–14.4.2

VendorProductVersionCPE
xwikixwiki*cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
xwikixwiki*cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
xwiki	xwiki	*	cpe:2.3:a:xwiki:xwiki::::::::
xwiki	xwiki	*	cpe:2.3:a:xwiki:xwiki::::::::

CNA Affected

[
  {
    "vendor": "xwiki",
    "product": "xwiki-platform",
    "versions": [
      {
        "version": ">= 6.4-milestone-2, < 13.10.7",
        "status": "affected"
      },
      {
        "version": ">= 14.0.0, < 14.4.2",
        "status": "affected"
      }
    ]
  }
]