CVE-2022-36097

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-36097
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-36097.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-36097
Aliases
Published
2022-09-08T20:35:11Z
Modified
2026-02-17T07:39:47.649644Z
Severity
  • 8.9 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L CVSS Calculator
Summary
XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form
Details

XWiki Platform Attachment UI provides a macro to easily upload and select attachments for XWiki Platform, a generic wiki platform. Starting with version 14.0-rc-1 and prior to 14.4-rc-1, it's possible to store JavaScript in an attachment name, which will be executed by anyone trying to move the corresponding attachment. This issue has been patched in XWiki 14.4-rc-1. As a workaround, one may copy moveStep1.vm to webapp/xwiki/templates/moveStep1.vm and replace vulnerable code with code from the patch.

Database specific 
{
    "cwe_ids": [
        "CWE-79",
        "CWE-80"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36097.json"
}
References

Affected packages

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
198ef99386911c0f7af11a0957092d349961e3a6
Fixed
970dc1c75c85849ba62b7b8b3d5eba16d26dd2ea

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-36097.json"