CVE-2022-36095CWE-352

XWiki Cross-Site Request Forgery (CSRF) for actions on tags

Medium · published September 8, 2022

CVSS v3.1
4.3
EPSS
0%
Percentile
35.0
In the wild
Unconfirmed
What it is

XWiki Platform is a generic wiki platform. Prior to versions 13.10.5 and 14.3, it is possible to perform a Cross-Site Request Forgery (CSRF) attack for adding or removing tags on XWiki pages. The problem has been patched in XWiki 13.10.5 and 14.3. As a workaround, one may locally modify the `documentTags.vm` template in one's filesystem, to apply the changes exposed there.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00418 · 35.0th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2022-09-08T20:20Z
EPSS history
Timeline
  • 08 SEP 20:20Z
    XWiki Cross-Site Request Forgery (CSRF) for actions on tags
    cvelistv5