XWiki Platform Web Parent POM vulnerable to XSS in the attachment history (xwiki xwiki-platform)
At a glance
- Source
- NVD
- EPSS
- EPSS 64.79 % · percentile 99 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Modified
Description
XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyone viewing the history of an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3RC1. As a workaround, it is possible to replace `viewattachrev.vm`, the entry point for this attack, by a patched version from the patch without updating XWiki.
Weaknesses (CWE)
- CWE-79 — Improper Neutralization of Input During Web Page Generation
- CWE-80 — Improper Neutralization of Script-Related HTML Tags in a Web Page
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L | GitHub_M |
| CVSS 3.1 | HIGH 8.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | CRITICAL 9.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-mxf2-4r22-5hq9 — XWiki Platform Web Parent POM vulnerable to XSS in the attachment history
European references
- ENISA EUVD · EUVD-2022-6885
- GCVE · GCVE-0-2022-36094
Affected configurations (NVD CPE)
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*≥ 1.0 < 13.10.6cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*≥ 14.0 < 14.3
Affected products
| Product | Versions |
|---|---|
| xwiki · xwiki-platform | affected >= 1.0, < 13.10.6 ; affected >= 14.0, < 14.3-rc-1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |