CVE-2022-29252
- Source
- https://cve.org/CVERecord?id=CVE-2022-29252
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29252.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-29252
- Aliases
- Published
- 2022-05-25T20:55:16Z
- Modified
- 2026-02-22T01:41:02.905600Z
- Severity
-
- 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N CVSS Calculator
- Summary
- Cross-site Scripting in XWiki Platform Wiki UI Main Wiki
- Details
-
XWiki Platform Wiki UI Main Wiki is a package for managing subwikis. Starting with version 5.3-milestone-2, XWiki Platform Wiki UI Main Wiki contains a possible cross-site scripting vector in the
WikiManager.JoinWikiwiki page related to the "requestJoin" field. The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3. The easiest available workaround is to edit the wiki pageWikiManager.JoinWiki(with wiki editor) according to the suggestion provided in the GitHub Security Advisory. - Database specific
{ "cna_assigner": "GitHub_M", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29252.json", "cwe_ids": [ "CWE-116", "CWE-80" ] }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29252.json
- https://github.com/xwiki/xwiki-platform/commit/27f839133d41877e538d35fa88274b50a1c00b9b
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ph5x-h23x-7q5q
- https://jira.xwiki.org/browse/XWIKI-19292
- https://nvd.nist.gov/vuln/detail/CVE-2022-29252