GitHub Advisoryadvisory · Maven

GHSA-fxwr-4vq9-9vhj XWiki Cross-Site Request Forgery (CSRF) for actions on tags

MEDIUM Published 2022-09-16 Modified 2022-09-16 Official page ↗
Aliases
CVE-2022-36095
Ecosystem
Maven
Packages
org.xwiki.platform:xwiki-platform-web-templates
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-352
Reviewed
2022-09-16

Affected packages

• Maven org.xwiki.platform:xwiki-platform-web-templates: >= 2.0-milestone-1, < 13.10.5 → fixed in 13.10.5 • Maven org.xwiki.platform:xwiki-platform-web-templates: >= 14.0, < 14.3 → fixed in 14.3

Description

Impact It's possible to perform a CSRF attack for adding or removing tags on XWiki pages. Patches The problem has been patched in XWiki 13.10.5 and 14.3. Workarounds It's possible to fix the issue without upgrading by locally modifying the documentTags.vm template in your filesystem, to apply the changes exposed there: https://github.com/xwiki/xwiki-platform/commit/7ca56e40cf79a468cea54d3480b6b403f259f9ae. References https://jira.xwiki.org/browse/XWIKI-19550 For more information If you have any questions or comments about this advisory: • Open an issue in Jira XWiki • Email us at security ML

Related

Alias · CVE (1)

  • CVE-2022-36095 XWiki Platform is a generic wiki platform. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References