Lucene search

GoogleOSV:CVE-2022-36095

HistorySep 08, 2022 - 9:15 p.m.

CVE-2022-36095

2022-09-0821:15:07

Google

osv.dev

xwiki platform

csrf vulnerability

versions 13.10.5

14.3

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.0%

JSON

XWiki Platform is a generic wiki platform. Prior to versions 13.10.5 and 14.3, it is possible to perform a Cross-Site Request Forgery (CSRF) attack for adding or removing tags on XWiki pages. The problem has been patched in XWiki 13.10.5 and 14.3. As a workaround, one may locally modify the documentTags.vm template in one’s filesystem, to apply the changes exposed there.

CPENameOperatorVersion
xwiki-commonseqxwiki-platform-8.0-milestone-1
xwiki-commonseqxwiki-platform-8.1-milestone-2
xwiki-commonseqxwiki-application-calendar-1.0
xwiki-commonseqxwiki-platform-7.4-milestone-2
xwiki-commonseqxwiki-plugin-tag-1.1
xwiki-commonseqxwiki-platform-7.3-milestone-2
xwiki-commonseqxwiki-platform-9.9-rc-2
xwiki-commonseqxwiki-platform-7.4-milestone-1
xwiki-commonseqxwiki-platform-8.1-milestone-1
xwiki-commonseqxwiki-platform-8.0-milestone-2

Name	Operator	Version
xwiki-commons	eq	xwiki-platform-8.0-milestone-1
xwiki-commons	eq	xwiki-platform-8.1-milestone-2
xwiki-commons	eq	xwiki-application-calendar-1.0
xwiki-commons	eq	xwiki-platform-7.4-milestone-2
xwiki-commons	eq	xwiki-plugin-tag-1.1
xwiki-commons	eq	xwiki-platform-7.3-milestone-2
xwiki-commons	eq	xwiki-platform-9.9-rc-2
xwiki-commons	eq	xwiki-platform-7.4-milestone-1
xwiki-commons	eq	xwiki-platform-8.1-milestone-1
xwiki-commons	eq	xwiki-platform-8.0-milestone-2

Rows per page:

1-10 of 131

References

github.com/xwiki/xwiki-platform/commit/7ca56e40cf79a468cea54d3480b6b403f259f9ae

github.com/xwiki/xwiki-platform/security/advisories/GHSA-fxwr-4vq9-9vhj

jira.xwiki.org/browse/XWIKI-19550

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.0%

JSON

Related for OSV:CVE-2022-36095