CVE-2022-36095

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-36095
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-36095.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-36095
Aliases
Published
2022-09-08T20:20:13Z
Modified
2026-08-12T03:51:18.618017553Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
Summary
XWiki Cross-Site Request Forgery (CSRF) for actions on tags
Details

XWiki Platform is a generic wiki platform. Prior to versions 13.10.5 and 14.3, it is possible to perform a Cross-Site Request Forgery (CSRF) attack for adding or removing tags on XWiki pages. The problem has been patched in XWiki 13.10.5 and 14.3. As a workaround, one may locally modify the documentTags.vm template in one's filesystem, to apply the changes exposed there.

Database specific 
{
    "cwe_ids": [
        "CWE-352"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36095.json"
}
References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-commons
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
479a47aeb015f634a121f1821642e0cb61dcc3d7
Introduced
491547c4f74b9be58123ef22081ae7e6840a11c7
Fixed
58bca6b6f0fb325008ef9147d3c0cdda3e1e306b
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "2.3"
        },
        {
            "fixed": "13.10.6"
        },
        {
            "introduced": "14.0"
        },
        {
            "fixed": "14.3"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
1bf0361e80e94dd763901e3a863b4caaa24b6e17
Fixed
c3f97150d6997ada95d919857fdc9690ed7ed316
Introduced
d971304b0e0bf4f6dad278de89518edc17459741
Fixed
585702c6749495ff837c791127e584668be87d74
Introduced
f874012b54d1bf48592881472747080c5de5dbbf
Fixed
7ca56e40cf79a468cea54d3480b6b403f259f9ae
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:xwiki:xwiki:2.0:milestone2:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "2.3"
        },
        {
            "fixed": "13.10.6"
        },
        {
            "introduced": "14.0"
        },
        {
            "fixed": "14.3"
        },
        {
            "introduced": "2.0-milestone2"
        },
        {
            "last_affected": "2.0-milestone2"
        }
    ]
}

Affected versions

2.*
2.0-milestone2
xwiki-commons-13.*
xwiki-commons-13.10
xwiki-commons-13.10-rc-1
xwiki-commons-13.10.1
xwiki-commons-13.10.2
xwiki-commons-13.10.3
xwiki-commons-13.10.4
xwiki-commons-13.10.5
xwiki-commons-14.*
xwiki-commons-14.3-rc-1
xwiki-commons-8.*
xwiki-commons-8.0-milestone-1
xwiki-commons-8.0-milestone-2
xwiki-commons-8.1-milestone-1
xwiki-commons-8.1-milestone-2
xwiki-commons-8.2-milestone-1
xwiki-commons-8.2-milestone-2
xwiki-commons-8.3-milestone-1
xwiki-commons-8.3-milestone-2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-36095.json"