CVE-2022-36094

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-36094
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-36094.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-36094
Aliases
Published
2022-09-08T20:10:09Z
Modified
2026-07-15T01:49:19.947968015Z
Severity
  • 8.9 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L CVSS Calculator
Summary
XWiki Platform Web Parent POM vulnerable to XSS in the attachment history
Details

XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyone viewing the history of an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3RC1. As a workaround, it is possible to replace viewattachrev.vm, the entry point for this attack, by a patched version from the patch without updating XWiki.

Database specific 
{
    "cwe_ids": [
        "CWE-79",
        "CWE-80"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36094.json"
}
References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-commons
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
479a47aeb015f634a121f1821642e0cb61dcc3d7
Introduced
491547c4f74b9be58123ef22081ae7e6840a11c7
Fixed
58bca6b6f0fb325008ef9147d3c0cdda3e1e306b
Database specific 
{
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.0"
        },
        {
            "fixed": "13.10.6"
        },
        {
            "introduced": "14.0"
        },
        {
            "fixed": "14.3"
        }
    ],
    "source": "CPE_RANGE"
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
93d8322eda7b68fd66f33334b982b047d7cf4f36
Fixed
c3f97150d6997ada95d919857fdc9690ed7ed316
Introduced
d971304b0e0bf4f6dad278de89518edc17459741
Fixed
585702c6749495ff837c791127e584668be87d74
Fixed
047ce9fa4a7c13f3883438aaf54fc50f287a7e8e
Database specific 
{
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.0"
        },
        {
            "fixed": "13.10.6"
        },
        {
            "introduced": "14.0"
        },
        {
            "fixed": "14.3"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

xwiki-commons-13.*
xwiki-commons-13.10
xwiki-commons-13.10-rc-1
xwiki-commons-13.10.1
xwiki-commons-13.10.2
xwiki-commons-13.10.3
xwiki-commons-13.10.4
xwiki-commons-13.10.5
xwiki-commons-14.*
xwiki-commons-14.3-rc-1
xwiki-commons-8.*
xwiki-commons-8.0-milestone-1
xwiki-commons-8.0-milestone-2
xwiki-commons-8.1-milestone-1
xwiki-commons-8.1-milestone-2
xwiki-commons-8.2-milestone-1
xwiki-commons-8.2-milestone-2
xwiki-commons-8.3-milestone-1
xwiki-commons-8.3-milestone-2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-36094.json"