XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list (xwiki xwiki-platform)
At a glance
- Source
- NVD
- EPSS
- EPSS 60.22 % · percentile 99 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Modified
Description
The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wiki platform. Prior to versions 13.10.6 and 14.3, it's possible to store JavaScript which will be executed by anyone viewing the deleted attachments index with an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3. As a workaround, modify fix the vulnerability by editing the wiki page `XWiki.DeletedAttachments` with the object editor, open the `JavaScriptExtension` object and apply on the content the changes that can be found on the fix commit.
Weaknesses (CWE)
- CWE-79 — Improper Neutralization of Input During Web Page Generation
- CWE-80 — Improper Neutralization of Script-Related HTML Tags in a Web Page
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L | GitHub_M |
| CVSS 3.1 | HIGH 8.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | CRITICAL 9.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-gjmq-x5x7-wc36 — XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list
European references
- ENISA EUVD · EUVD-2022-6824
- GCVE · GCVE-0-2022-36096
Affected configurations (NVD CPE)
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*≥ 2.3 < 13.10.6cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*≥ 14.0 < 14.3cpe:2.3:a:xwiki:xwiki:2.2:milestone1:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| xwiki · xwiki-platform | affected >= 2.2-milestone-1, < 13.10.6 ; affected >= 14.0, < 14.3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |