CVE-2022-23620CWE-22

Path traversal in xwiki-platform-skin-skinx

Medium · published February 9, 2022

CVSS v3.1
6.8
EPSS
1%
Percentile
61.1
In the wild
Unconfirmed
What it is

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionHandler#processSx does not escape anything from SSX document references when serializing it on filesystem, it is possible to for the HTML export process to contain reference elements containing filesystem syntax like "../", "./". or "/" in general. The referenced elements are not properly escaped. This issue has been resolved in version 13.6-rc-1. This issue can be worked around by limiting or disabling document export.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00957 · 61.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2022-02-09T21:15Z
EPSS history
Timeline
  • 09 FEB 21:15Z
    Path traversal in xwiki-platform-skin-skinx
    cvelistv5