CVE-2022-36094CWE-79CWE-80

XWiki Platform Web Parent POM vulnerable to XSS in the attachment history

High · published September 8, 2022

Patch now

High probability of exploitation

CVSS calls it high at 8.9. It sits in the 99.2th percentile for exploit probability.

CVSS v3.1
8.9
EPSS
65%
Percentile
99.2
In the wild
Unconfirmed
What it is

XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyone viewing the history of an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3RC1. As a workaround, it is possible to replace `viewattachrev.vm`, the entry point for this attack, by a patched version from the patch without updating XWiki.

The record
Technical detail
CVSS v3.1
8.9 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.64794 · 99.2th percentile
Weaknesses
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2022-09-08T20:10Z
EPSS history
Timeline
  • 08 SEP 20:10Z
    XWiki Platform Web Parent POM vulnerable to XSS in the attachment history
    cvelistv5