XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml (xwiki xwiki-platform)
At a glance
- Source
- NVD
- EPSS
- EPSS 1.05 % · percentile 64 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Modified
Description
XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml. The issue can also be reproduced by inserting the dangerous payload in the `height` or `alt` macro properties. This has been patched in versions 13.10.7, 14.4.2, and 14.5. The issue can be fixed on a running wiki by updating `XWiki.AttachmentSelector` with the versions below: - 14.5-rc-1+: https://github.com/xwiki/xwiki-platform/commit/eb15147adf94bddb92626f862c1710d45bcd64a7#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 - 14.4.2+: https://github.com/xwiki/xwiki-platform/commit/c02f8eb1f3c953d124f2c097021536f8bc00fa8d#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 - 13.10.7+: https://github.com/xwiki/xwiki-platform/commit/efd0df0468d46149ba68b66660b93f31b6318515#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23
Weaknesses (CWE)
- CWE-95 — Improper Neutralization of Directives in Dynamically Evaluated Code
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | GitHub_M |
| CVSS 3.1 | CRITICAL 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-9hqh-fmhg-vq2j — Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml
European references
- ENISA EUVD · EUVD-2022-7304
- GCVE · GCVE-0-2022-41928
Affected configurations (NVD CPE)
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*> 5.0 < 13.10.7cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*≥ 14.0.0 < 14.4.2cpe:2.3:a:xwiki:xwiki:5.0:milestone1:*:*:*:*:*:*cpe:2.3:a:xwiki:xwiki:5.0:milestone2:*:*:*:*:*:*cpe:2.3:a:xwiki:xwiki:14.4.3:*:*:*:*:*:*:*cpe:2.3:a:xwiki:xwiki:14.4.4:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| xwiki · xwiki-platform | affected >= 5.0-milestone-1, < 13.10.7 ; affected >= 14.0.0, < 14.4.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |