GitHub Advisoryadvisory · Maven

GHSA-mxf2-4r22-5hq9 XWiki Platform Web Parent POM vulnerable to XSS in the attachment history

HIGH Published 2022-09-16 Modified 2022-09-16 Official page ↗
Aliases
CVE-2022-36094
Ecosystem
Maven
Packages
org.xwiki.platform:xwiki-platform-web
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
Weaknesses
CWE-79, CWE-80
Reviewed
2022-09-16

Affected packages

• Maven org.xwiki.platform:xwiki-platform-web: >= 1.0, < 13.10.6 → fixed in 13.10.6 • Maven org.xwiki.platform:xwiki-platform-web: >= 14.0, < 14.3-rc-1 → fixed in 14.3-rc-1

Description

Impact It's possible to store a JavaScript which will be executed by anyone viewing the history of an attachment containing javascript in its name. For example, attachment a file with name `>.jpg` will execute the alert. Patches This issue has been patched in XWiki 13.10.6 and 14.3RC1. Workarounds It is possible to replace viewattachrev.vm, the entry point for this attack, by a patched version from the patch without updating XWiki. References • https://jira.xwiki.org/browse/XWIKI-19612 For more information If you have any questions or comments about this advisory: • Open an issue in Jira XWiki.org • Email us at Security Mailing List

Related

Alias · CVE (1)

  • CVE-2022-36094 XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. vulnerability

Weakness · CWE (2)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References