CVE-2022-36097CWE-79CWE-80

XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form

High · published September 8, 2022

Patch now

High probability of exploitation

CVSS calls it high at 8.9. It sits in the 99.1th percentile for exploit probability.

CVSS v3.1
8.9
EPSS
58%
Percentile
99.1
In the wild
Unconfirmed
What it is

XWiki Platform Attachment UI provides a macro to easily upload and select attachments for XWiki Platform, a generic wiki platform. Starting with version 14.0-rc-1 and prior to 14.4-rc-1, it's possible to store JavaScript in an attachment name, which will be executed by anyone trying to move the corresponding attachment. This issue has been patched in XWiki 14.4-rc-1. As a workaround, one may copy `moveStep1.vm` to `webapp/xwiki/templates/moveStep1.vm` and replace vulnerable code with code from the patch.

The record
Technical detail
CVSS v3.1
8.9 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.58162 · 99.1th percentile
Weaknesses
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2022-09-08T20:35Z
EPSS history
Timeline
  • 08 SEP 20:35Z
    XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form
    cvelistv5