cvelistv5 - cve-2022-36098

cve-2022-36098

Vulnerability from cvelistv5

Published

2022-09-08 20:50

Modified

2025-04-22 17:22

Severity ?

8.9 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

EPSS score ?

26.15% (0.95949)

Summary

XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a mention, macro anchor, or reference field. The stored code is executed by anyone visiting the page with the mention. This issue has been patched on XWiki 14.4 and 13.10.6. As a workaround, one may update `XWiki.Mentions.MentionsMacro` and edit the `Macro code` field of the `XWiki.WikiMacroClass` XObject.

References

URL	Tags
security-advisories@github.com	https://github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459#diff-4fe22885f772e47d3561a05348f73921669ec12d4413b220383b73c7ae484bc4R608-R610	Patch, Third Party Advisory
security-advisories@github.com	https://github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb	Patch, Third Party Advisory
security-advisories@github.com	https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5v8-2q4r-5w9v	Exploit, Patch, Third Party Advisory
security-advisories@github.com	https://jira.xwiki.org/browse/XWIKI-19752	Exploit, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459#diff-4fe22885f772e47d3561a05348f73921669ec12d4413b220383b73c7ae484bc4R608-R610	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5v8-2q4r-5w9v	Exploit, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://jira.xwiki.org/browse/XWIKI-19752	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	xwiki	xwiki-platform	Version: >= 12.5-rc-1, < 13.10.6 Version: >= 14.0, < 14.4

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T09:52:00.552Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5v8-2q4r-5w9v",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459#diff-4fe22885f772e47d3561a05348f73921669ec12d4413b220383b73c7ae484bc4R608-R610",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://jira.xwiki.org/browse/XWIKI-19752",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-36098",
                        options: [
                           {
                              Exploitation: "poc",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-22T15:41:45.397338Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-22T17:22:36.540Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "xwiki-platform",
               vendor: "xwiki",
               versions: [
                  {
                     status: "affected",
                     version: ">= 12.5-rc-1, < 13.10.6",
                  },
                  {
                     status: "affected",
                     version: ">= 14.0, < 14.4",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a mention, macro anchor, or reference field. The stored code is executed by anyone visiting the page with the mention. This issue has been patched on XWiki 14.4 and 13.10.6. As a workaround, one may update `XWiki.Mentions.MentionsMacro` and edit the `Macro code` field of the `XWiki.WikiMacroClass` XObject.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 8.9,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-79",
                     description: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-09-08T20:50:11.000Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5v8-2q4r-5w9v",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459#diff-4fe22885f772e47d3561a05348f73921669ec12d4413b220383b73c7ae484bc4R608-R610",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://jira.xwiki.org/browse/XWIKI-19752",
            },
         ],
         source: {
            advisory: "GHSA-c5v8-2q4r-5w9v",
            discovery: "UNKNOWN",
         },
         title: "XWiki Platform Mentions UI vulnerable to Cross-site Scripting",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-advisories@github.com",
               ID: "CVE-2022-36098",
               STATE: "PUBLIC",
               TITLE: "XWiki Platform Mentions UI vulnerable to Cross-site Scripting",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "xwiki-platform",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: ">= 12.5-rc-1, < 13.10.6",
                                       },
                                       {
                                          version_value: ">= 14.0, < 14.4",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "xwiki",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a mention, macro anchor, or reference field. The stored code is executed by anyone visiting the page with the mention. This issue has been patched on XWiki 14.4 and 13.10.6. As a workaround, one may update `XWiki.Mentions.MentionsMacro` and edit the `Macro code` field of the `XWiki.WikiMacroClass` XObject.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 8.9,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5v8-2q4r-5w9v",
                     refsource: "CONFIRM",
                     url: "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5v8-2q4r-5w9v",
                  },
                  {
                     name: "https://github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459#diff-4fe22885f772e47d3561a05348f73921669ec12d4413b220383b73c7ae484bc4R608-R610",
                     refsource: "MISC",
                     url: "https://github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459#diff-4fe22885f772e47d3561a05348f73921669ec12d4413b220383b73c7ae484bc4R608-R610",
                  },
                  {
                     name: "https://github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb",
                     refsource: "MISC",
                     url: "https://github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb",
                  },
                  {
                     name: "https://jira.xwiki.org/browse/XWIKI-19752",
                     refsource: "MISC",
                     url: "https://jira.xwiki.org/browse/XWIKI-19752",
                  },
               ],
            },
            source: {
               advisory: "GHSA-c5v8-2q4r-5w9v",
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2022-36098",
      datePublished: "2022-09-08T20:50:11.000Z",
      dateReserved: "2022-07-15T00:00:00.000Z",
      dateUpdated: "2025-04-22T17:22:36.540Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2022-36098\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2022-09-08T21:15:08.097\",\"lastModified\":\"2024-11-21T07:12:23.000\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a mention, macro anchor, or reference field. The stored code is executed by anyone visiting the page with the mention. This issue has been patched on XWiki 14.4 and 13.10.6. As a workaround, one may update `XWiki.Mentions.MentionsMacro` and edit the `Macro code` field of the `XWiki.WikiMacroClass` XObject.\"},{\"lang\":\"es\",\"value\":\"XWiki Platform Mentions UI es una Interfaz de Usuario para mencionar usuarios en contenido wiki para XWiki Platform, una plataforma wiki genérica.&#xa0;A partir de la versión 12.5-rc-1 y anteriores a 13.10.6 y 14.4, es posible almacenar Javascript o scripts maravillosos en un campo de mención, ancla de macro o referencia.&#xa0;El código almacenado es ejecutado por cualquiera que visite la página con la mención.&#xa0;Este problema ha sido parcheado en XWiki versiones 14.4 y 13.10.6.&#xa0;Como mitigación, puede actualizarse \\\"XWiki.Mentions.MentionsMacro\\\" y editar el campo \\\"Macro code\\\" del XObject \\\"XWiki.WikiMacroClass\\\"\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L\",\"baseScore\":8.9,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.3,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H\",\"baseScore\":9.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.3,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"12.5\",\"versionEndExcluding\":\"13.10.6\",\"matchCriteriaId\":\"ED6936AF-2696-4165-B7AD-54CF65C6A904\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"14.0\",\"versionEndExcluding\":\"14.4\",\"matchCriteriaId\":\"78E9227E-5BAE-44FD-B327-13434E0AF974\"}]}]}],\"references\":[{\"url\":\"https://github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459#diff-4fe22885f772e47d3561a05348f73921669ec12d4413b220383b73c7ae484bc4R608-R610\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5v8-2q4r-5w9v\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://jira.xwiki.org/browse/XWIKI-19752\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459#diff-4fe22885f772e47d3561a05348f73921669ec12d4413b220383b73c7ae484bc4R608-R610\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5v8-2q4r-5w9v\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://jira.xwiki.org/browse/XWIKI-19752\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5v8-2q4r-5w9v\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459#diff-4fe22885f772e47d3561a05348f73921669ec12d4413b220383b73c7ae484bc4R608-R610\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://jira.xwiki.org/browse/XWIKI-19752\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T09:52:00.552Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-36098\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-22T15:41:45.397338Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-22T15:41:48.401Z\"}}], \"cna\": {\"title\": \"XWiki Platform Mentions UI vulnerable to Cross-site Scripting\", \"source\": {\"advisory\": \"GHSA-c5v8-2q4r-5w9v\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"xwiki\", \"product\": \"xwiki-platform\", \"versions\": [{\"status\": \"affected\", \"version\": \">= 12.5-rc-1, < 13.10.6\"}, {\"status\": \"affected\", \"version\": \">= 14.0, < 14.4\"}]}], \"references\": [{\"url\": \"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5v8-2q4r-5w9v\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459#diff-4fe22885f772e47d3561a05348f73921669ec12d4413b220383b73c7ae484bc4R608-R610\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://jira.xwiki.org/browse/XWIKI-19752\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a mention, macro anchor, or reference field. The stored code is executed by anyone visiting the page with the mention. This issue has been patched on XWiki 14.4 and 13.10.6. As a workaround, one may update `XWiki.Mentions.MentionsMacro` and edit the `Macro code` field of the `XWiki.WikiMacroClass` XObject.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2022-09-08T20:50:11.000Z\"}, \"x_legacyV4Record\": {\"impact\": {\"cvss\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, \"source\": {\"advisory\": \"GHSA-c5v8-2q4r-5w9v\", \"discovery\": \"UNKNOWN\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"version_value\": \">= 12.5-rc-1, < 13.10.6\"}, {\"version_value\": \">= 14.0, < 14.4\"}]}, \"product_name\": \"xwiki-platform\"}]}, \"vendor_name\": \"xwiki\"}]}}, \"data_type\": \"CVE\", \"references\": {\"reference_data\": [{\"url\": \"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5v8-2q4r-5w9v\", \"name\": \"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5v8-2q4r-5w9v\", \"refsource\": \"CONFIRM\"}, {\"url\": \"https://github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459#diff-4fe22885f772e47d3561a05348f73921669ec12d4413b220383b73c7ae484bc4R608-R610\", \"name\": \"https://github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459#diff-4fe22885f772e47d3561a05348f73921669ec12d4413b220383b73c7ae484bc4R608-R610\", \"refsource\": \"MISC\"}, {\"url\": \"https://github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb\", \"name\": \"https://github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb\", \"refsource\": \"MISC\"}, {\"url\": \"https://jira.xwiki.org/browse/XWIKI-19752\", \"name\": \"https://jira.xwiki.org/browse/XWIKI-19752\", \"refsource\": \"MISC\"}]}, \"data_format\": \"MITRE\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a mention, macro anchor, or reference field. The stored code is executed by anyone visiting the page with the mention. This issue has been patched on XWiki 14.4 and 13.10.6. As a workaround, one may update `XWiki.Mentions.MentionsMacro` and edit the `Macro code` field of the `XWiki.WikiMacroClass` XObject.\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\"}]}]}, \"data_version\": \"4.0\", \"CVE_data_meta\": {\"ID\": \"CVE-2022-36098\", \"STATE\": \"PUBLIC\", \"TITLE\": \"XWiki Platform Mentions UI vulnerable to Cross-site Scripting\", \"ASSIGNER\": \"security-advisories@github.com\"}}}}",
         cveMetadata: "{\"cveId\": \"CVE-2022-36098\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-22T17:22:36.540Z\", \"dateReserved\": \"2022-07-15T00:00:00.000Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2022-09-08T20:50:11.000Z\", \"assignerShortName\": \"GitHub_M\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}

gsd-2022-36098

Vulnerability from gsd

Modified

2023-12-13 01:19

Details

Aliases

CVE-2022-36098

Aliases

CVE-2022-36098

JSON

To clipboard

{
   GSD: {
      alias: "CVE-2022-36098",
      description: "XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a mention, macro anchor, or reference field. The stored code is executed by anyone visiting the page with the mention. This issue has been patched on XWiki 14.4 and 13.10.6. As a workaround, one may update `XWiki.Mentions.MentionsMacro` and edit the `Macro code` field of the `XWiki.WikiMacroClass` XObject.",
      id: "GSD-2022-36098",
   },
   gsd: {
      metadata: {
         exploitCode: "unknown",
         remediation: "unknown",
         reportConfidence: "confirmed",
         type: "vulnerability",
      },
      osvSchema: {
         aliases: [
            "CVE-2022-36098",
         ],
         details: "XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a mention, macro anchor, or reference field. The stored code is executed by anyone visiting the page with the mention. This issue has been patched on XWiki 14.4 and 13.10.6. As a workaround, one may update `XWiki.Mentions.MentionsMacro` and edit the `Macro code` field of the `XWiki.WikiMacroClass` XObject.",
         id: "GSD-2022-36098",
         modified: "2023-12-13T01:19:21.272472Z",
         schema_version: "1.4.0",
      },
   },
   namespaces: {
      "cve.org": {
         CVE_data_meta: {
            ASSIGNER: "security-advisories@github.com",
            ID: "CVE-2022-36098",
            STATE: "PUBLIC",
            TITLE: "XWiki Platform Mentions UI vulnerable to Cross-site Scripting",
         },
         affects: {
            vendor: {
               vendor_data: [
                  {
                     product: {
                        product_data: [
                           {
                              product_name: "xwiki-platform",
                              version: {
                                 version_data: [
                                    {
                                       version_value: ">= 12.5-rc-1, < 13.10.6",
                                    },
                                    {
                                       version_value: ">= 14.0, < 14.4",
                                    },
                                 ],
                              },
                           },
                        ],
                     },
                     vendor_name: "xwiki",
                  },
               ],
            },
         },
         data_format: "MITRE",
         data_type: "CVE",
         data_version: "4.0",
         description: {
            description_data: [
               {
                  lang: "eng",
                  value: "XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a mention, macro anchor, or reference field. The stored code is executed by anyone visiting the page with the mention. This issue has been patched on XWiki 14.4 and 13.10.6. As a workaround, one may update `XWiki.Mentions.MentionsMacro` and edit the `Macro code` field of the `XWiki.WikiMacroClass` XObject.",
               },
            ],
         },
         impact: {
            cvss: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "LOW",
               baseScore: 8.9,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "LOW",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L",
               version: "3.1",
            },
         },
         problemtype: {
            problemtype_data: [
               {
                  description: [
                     {
                        lang: "eng",
                        value: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                     },
                  ],
               },
            ],
         },
         references: {
            reference_data: [
               {
                  name: "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5v8-2q4r-5w9v",
                  refsource: "CONFIRM",
                  url: "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5v8-2q4r-5w9v",
               },
               {
                  name: "https://github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459#diff-4fe22885f772e47d3561a05348f73921669ec12d4413b220383b73c7ae484bc4R608-R610",
                  refsource: "MISC",
                  url: "https://github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459#diff-4fe22885f772e47d3561a05348f73921669ec12d4413b220383b73c7ae484bc4R608-R610",
               },
               {
                  name: "https://github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb",
                  refsource: "MISC",
                  url: "https://github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb",
               },
               {
                  name: "https://jira.xwiki.org/browse/XWIKI-19752",
                  refsource: "MISC",
                  url: "https://jira.xwiki.org/browse/XWIKI-19752",
               },
            ],
         },
         source: {
            advisory: "GHSA-c5v8-2q4r-5w9v",
            discovery: "UNKNOWN",
         },
      },
      "gitlab.com": {
         advisories: [
            {
               affected_range: "[12.5-rc-1,13.10.6),[14.0,14.4)",
               affected_versions: "All versions starting from 12.5-rc-1 before 13.10.6, all versions starting from 14.0 before 14.4",
               cvss_v3: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
               cwe_ids: [
                  "CWE-1035",
                  "CWE-78",
                  "CWE-79",
                  "CWE-937",
               ],
               date: "2022-09-16",
               description: "XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a mention, macro anchor, or reference field. The stored code is executed by anyone visiting the page with the mention. This issue has been patched on XWiki 14.4 and 13.10.6. As a workaround, one may update `XWiki.Mentions.MentionsMacro` and edit the `Macro code` field of the `XWiki.WikiMacroClass` XObject.",
               fixed_versions: [
                  "13.10.6",
                  "14.4",
               ],
               identifier: "CVE-2022-36098",
               identifiers: [
                  "GHSA-c5v8-2q4r-5w9v",
                  "CVE-2022-36098",
               ],
               not_impacted: "All versions before 12.5-rc-1, all versions starting from 13.10.6 before 14.0, all versions starting from 14.4",
               package_slug: "maven/org.xwiki.platform/xwiki-platform-mentions-ui",
               pubdate: "2022-09-16",
               solution: "Upgrade to versions 13.10.6, 14.4 or above.",
               title: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
               urls: [
                  "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5v8-2q4r-5w9v",
                  "https://nvd.nist.gov/vuln/detail/CVE-2022-36098",
                  "https://github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459#diff-4fe22885f772e47d3561a05348f73921669ec12d4413b220383b73c7ae484bc4R608-R610",
                  "https://github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb",
                  "https://jira.xwiki.org/browse/XWIKI-19752",
                  "https://github.com/advisories/GHSA-c5v8-2q4r-5w9v",
               ],
               uuid: "8ac957ed-53ab-4d2a-8559-0ad7fc981942",
            },
         ],
      },
      "nvd.nist.gov": {
         configurations: {
            CVE_data_version: "4.0",
            nodes: [
               {
                  children: [],
                  cpe_match: [
                     {
                        cpe23Uri: "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
                        cpe_name: [],
                        versionEndExcluding: "14.4",
                        versionStartIncluding: "14.0",
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
                        cpe_name: [],
                        versionEndExcluding: "13.10.6",
                        versionStartIncluding: "12.5",
                        vulnerable: true,
                     },
                  ],
                  operator: "OR",
               },
            ],
         },
         cve: {
            CVE_data_meta: {
               ASSIGNER: "security-advisories@github.com",
               ID: "CVE-2022-36098",
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "en",
                     value: "XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a mention, macro anchor, or reference field. The stored code is executed by anyone visiting the page with the mention. This issue has been patched on XWiki 14.4 and 13.10.6. As a workaround, one may update `XWiki.Mentions.MentionsMacro` and edit the `Macro code` field of the `XWiki.WikiMacroClass` XObject.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "en",
                           value: "CWE-79",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459#diff-4fe22885f772e47d3561a05348f73921669ec12d4413b220383b73c7ae484bc4R608-R610",
                     refsource: "MISC",
                     tags: [
                        "Patch",
                        "Third Party Advisory",
                     ],
                     url: "https://github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459#diff-4fe22885f772e47d3561a05348f73921669ec12d4413b220383b73c7ae484bc4R608-R610",
                  },
                  {
                     name: "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5v8-2q4r-5w9v",
                     refsource: "CONFIRM",
                     tags: [
                        "Exploit",
                        "Patch",
                        "Third Party Advisory",
                     ],
                     url: "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5v8-2q4r-5w9v",
                  },
                  {
                     name: "https://github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb",
                     refsource: "MISC",
                     tags: [
                        "Patch",
                        "Third Party Advisory",
                     ],
                     url: "https://github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb",
                  },
                  {
                     name: "https://jira.xwiki.org/browse/XWIKI-19752",
                     refsource: "MISC",
                     tags: [
                        "Exploit",
                        "Vendor Advisory",
                     ],
                     url: "https://jira.xwiki.org/browse/XWIKI-19752",
                  },
               ],
            },
         },
         impact: {
            baseMetricV3: {
               cvssV3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 9,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               exploitabilityScore: 2.3,
               impactScore: 6,
            },
         },
         lastModifiedDate: "2022-09-13T19:37Z",
         publishedDate: "2022-09-08T21:15Z",
      },
   },
}

fkie_cve-2022-36098

Vulnerability from fkie_nvd

Published

2022-09-08 21:15

Modified

2024-11-21 07:12

Severity ?

8.9 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
9.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459#diff-4fe22885f772e47d3561a05348f73921669ec12d4413b220383b73c7ae484bc4R608-R610	Patch, Third Party Advisory
security-advisories@github.com	https://github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb	Patch, Third Party Advisory
security-advisories@github.com	https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5v8-2q4r-5w9v	Exploit, Patch, Third Party Advisory
security-advisories@github.com	https://jira.xwiki.org/browse/XWIKI-19752	Exploit, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459#diff-4fe22885f772e47d3561a05348f73921669ec12d4413b220383b73c7ae484bc4R608-R610	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5v8-2q4r-5w9v	Exploit, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://jira.xwiki.org/browse/XWIKI-19752	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	xwiki	xwiki	*
	xwiki	xwiki	*

JSON

To clipboard

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "ED6936AF-2696-4165-B7AD-54CF65C6A904",
                     versionEndExcluding: "13.10.6",
                     versionStartIncluding: "12.5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "78E9227E-5BAE-44FD-B327-13434E0AF974",
                     versionEndExcluding: "14.4",
                     versionStartIncluding: "14.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a mention, macro anchor, or reference field. The stored code is executed by anyone visiting the page with the mention. This issue has been patched on XWiki 14.4 and 13.10.6. As a workaround, one may update `XWiki.Mentions.MentionsMacro` and edit the `Macro code` field of the `XWiki.WikiMacroClass` XObject.",
      },
      {
         lang: "es",
         value: "XWiki Platform Mentions UI es una Interfaz de Usuario para mencionar usuarios en contenido wiki para XWiki Platform, una plataforma wiki genérica.&#xa0;A partir de la versión 12.5-rc-1 y anteriores a 13.10.6 y 14.4, es posible almacenar Javascript o scripts maravillosos en un campo de mención, ancla de macro o referencia.&#xa0;El código almacenado es ejecutado por cualquiera que visite la página con la mención.&#xa0;Este problema ha sido parcheado en XWiki versiones 14.4 y 13.10.6.&#xa0;Como mitigación, puede actualizarse \"XWiki.Mentions.MentionsMacro\" y editar el campo \"Macro code\" del XObject \"XWiki.WikiMacroClass\"",
      },
   ],
   id: "CVE-2022-36098",
   lastModified: "2024-11-21T07:12:23.000",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "LOW",
               baseScore: 8.9,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "LOW",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L",
               version: "3.1",
            },
            exploitabilityScore: 2.3,
            impactScore: 6,
            source: "security-advisories@github.com",
            type: "Secondary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 9,
               baseSeverity: "CRITICAL",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "LOW",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.3,
            impactScore: 6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2022-09-08T21:15:08.097",
   references: [
      {
         source: "security-advisories@github.com",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459#diff-4fe22885f772e47d3561a05348f73921669ec12d4413b220383b73c7ae484bc4R608-R610",
      },
      {
         source: "security-advisories@github.com",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb",
      },
      {
         source: "security-advisories@github.com",
         tags: [
            "Exploit",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5v8-2q4r-5w9v",
      },
      {
         source: "security-advisories@github.com",
         tags: [
            "Exploit",
            "Vendor Advisory",
         ],
         url: "https://jira.xwiki.org/browse/XWIKI-19752",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459#diff-4fe22885f772e47d3561a05348f73921669ec12d4413b220383b73c7ae484bc4R608-R610",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5v8-2q4r-5w9v",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
            "Vendor Advisory",
         ],
         url: "https://jira.xwiki.org/browse/XWIKI-19752",
      },
   ],
   sourceIdentifier: "security-advisories@github.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-79",
            },
         ],
         source: "security-advisories@github.com",
         type: "Primary",
      },
   ],
}

ghsa-c5v8-2q4r-5w9v

Vulnerability from github

Published

2022-09-16 17:36

Modified

2022-09-16 17:36

Severity ?

9.9 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Summary

XWiki Platform Mentions UI vulnerable to Cross-site Scripting

Details

Impact

It's possible to store Javascript or groovy scripts in an mention macro anchor or reference field. The stored code is executed by anyone visiting the page with the mention.

For example, the example below will create a file at /tmp/exploit.txt:

{{mention reference="XWiki.Translation" anchor="{{/html~}~}{{async async=~"true~" cached=~"false~" context=~"doc.reference~"~}~}{{groovy~}~}new File(~"/tmp/exploit.txt~").withWriter { out -> out.println(~"owned!~"); }{{/groovy~}~}{{/async~}~}"/}}

Patches

This issue has been patched on XWiki 14.4 and 13.10.6.

Workarounds

It's possible to fix the vulnerability by updating XWiki.Mentions.MentionsMacro and edit the Macro code field of the XWiki.WikiMacroClass XObject.

velocity <a id="$anchor" class="$stringtool.join($cssClasses, ' ')" data-reference="$services.model.serialize($reference.reference, 'default')" href="$link">$content</a>

Must be replaced by

velocity <a id="$escapetool.xml($anchor)" class="$stringtool.join($cssClasses, ' ')" data-reference="$escapetool.xml($services.model.serialize($reference.reference, 'default'))" href="$escapetool.xml($link)"> $escapetool.xml($content) </a>

See the patches: - 14.4: https://github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb - 13.10.6: https://github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459#diff-4fe22885f772e47d3561a05348f73921669ec12d4413b220383b73c7ae484bc4R608-R610

References

https://jira.xwiki.org/browse/XWIKI-19752

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

Show details on source website

JSON

To clipboard

{
   affected: [
      {
         package: {
            ecosystem: "Maven",
            name: "org.xwiki.platform:xwiki-platform-mentions-ui",
         },
         ranges: [
            {
               events: [
                  {
                     introduced: "12.5-rc-1",
                  },
                  {
                     fixed: "13.10.6",
                  },
               ],
               type: "ECOSYSTEM",
            },
         ],
      },
      {
         package: {
            ecosystem: "Maven",
            name: "org.xwiki.platform:xwiki-platform-mentions-ui",
         },
         ranges: [
            {
               events: [
                  {
                     introduced: "14.0",
                  },
                  {
                     fixed: "14.4",
                  },
               ],
               type: "ECOSYSTEM",
            },
         ],
      },
   ],
   aliases: [
      "CVE-2022-36098",
   ],
   database_specific: {
      cwe_ids: [
         "CWE-79",
      ],
      github_reviewed: true,
      github_reviewed_at: "2022-09-16T17:36:44Z",
      nvd_published_at: "2022-09-08T21:15:00Z",
      severity: "CRITICAL",
   },
   details: "### Impact\nIt's possible to store Javascript or groovy scripts in an mention macro anchor or reference field. The stored code is executed by anyone visiting the page with the mention.\n\nFor example, the example below will create a file at `/tmp/exploit.txt`:\n\n```\n{{mention reference=\"XWiki.Translation\" anchor=\"{{/html~}~}{{async async=~\"true~\" cached=~\"false~\" context=~\"doc.reference~\"~}~}{{groovy~}~}new File(~\"/tmp/exploit.txt~\").withWriter { out -> out.println(~\"owned!~\"); }{{/groovy~}~}{{/async~}~}\"/}}\n```\n\n### Patches\nThis issue has been patched on XWiki 14.4 and 13.10.6.\n\n### Workarounds\nIt's possible to fix the vulnerability by updating `XWiki.Mentions.MentionsMacro` and edit the `Macro code` field of the `XWiki.WikiMacroClass` XObject.\n\n```velocity\n<a id=\"$anchor\" class=\"$stringtool.join($cssClasses, ' ')\" data-reference=\"$services.model.serialize($reference.reference, 'default')\" href=\"$link\">$content</a>\n```\n\nMust be replaced by \n\n```velocity\n<a id=\"$escapetool.xml($anchor)\" class=\"$stringtool.join($cssClasses, ' ')\" data-reference=\"$escapetool.xml($services.model.serialize($reference.reference, 'default'))\" href=\"$escapetool.xml($link)\">\n  $escapetool.xml($content)\n</a>\n```\n\nSee the patches:\n- 14.4: https://github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb\n- 13.10.6: https://github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459#diff-4fe22885f772e47d3561a05348f73921669ec12d4413b220383b73c7ae484bc4R608-R610\n\n### References\n\n- https://jira.xwiki.org/browse/XWIKI-19752\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n- Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n- Email us at [Security Mailing List](mailto:security@xwiki.org)",
   id: "GHSA-c5v8-2q4r-5w9v",
   modified: "2022-09-16T17:36:44Z",
   published: "2022-09-16T17:36:44Z",
   references: [
      {
         type: "WEB",
         url: "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5v8-2q4r-5w9v",
      },
      {
         type: "ADVISORY",
         url: "https://nvd.nist.gov/vuln/detail/CVE-2022-36098",
      },
      {
         type: "WEB",
         url: "https://github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459#diff-4fe22885f772e47d3561a05348f73921669ec12d4413b220383b73c7ae484bc4R608-R610",
      },
      {
         type: "WEB",
         url: "https://github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb",
      },
      {
         type: "PACKAGE",
         url: "https://github.com/xwiki/xwiki-platform",
      },
      {
         type: "WEB",
         url: "https://jira.xwiki.org/browse/XWIKI-19752",
      },
   ],
   schema_version: "1.4.0",
   severity: [
      {
         score: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
         type: "CVSS_V3",
      },
   ],
   summary: "XWiki Platform Mentions UI vulnerable to Cross-site Scripting",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

cve-2022-36098

Vulnerability from cvelistv5

gsd-2022-36098

Vulnerability from gsd

fkie_cve-2022-36098

Vulnerability from fkie_nvd

ghsa-c5v8-2q4r-5w9v

Vulnerability from github

Impact

Patches

Workarounds

References

For more information

Tags

Sightings

Nomenclature