CVE-2022-36098

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-36098
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-36098.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-36098
Aliases
Published
2022-09-08T20:50:11Z
Modified
2026-08-12T03:51:31.486780885Z
Severity
  • 8.9 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L CVSS Calculator
Summary
XWiki Platform Mentions UI vulnerable to Cross-site Scripting
Details

XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a mention, macro anchor, or reference field. The stored code is executed by anyone visiting the page with the mention. This issue has been patched on XWiki 14.4 and 13.10.6. As a workaround, one may update XWiki.Mentions.MentionsMacro and edit the Macro code field of the XWiki.WikiMacroClass XObject.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36098.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-commons
Events
Introduced
9c0539e3b1f7a819bfbf4914fc05788308a4f7d0
Fixed
479a47aeb015f634a121f1821642e0cb61dcc3d7
Introduced
491547c4f74b9be58123ef22081ae7e6840a11c7
Fixed
17d3df2f9d5cf80b652df565e0c7533e0404fc0d
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "12.5"
        },
        {
            "fixed": "13.10.6"
        },
        {
            "introduced": "14.0"
        },
        {
            "fixed": "14.4"
        }
    ],
    "source": "CPE_RANGE"
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
5e4e15c6a4653d53cc34657cebd5e2989e3694de
Fixed
c3f97150d6997ada95d919857fdc9690ed7ed316
Introduced
d971304b0e0bf4f6dad278de89518edc17459741
Fixed
5d23a4d1ec341678fa8f1c2ac60d50f0a16f5e3b
Fixed
4032dc896857597efd169966dc9e2752a9fdd459
Fixed
4f290d87a8355e967378a1ed6aee23a06ba162eb
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "12.5"
        },
        {
            "fixed": "13.10.6"
        },
        {
            "introduced": "14.0"
        },
        {
            "fixed": "14.4"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-36098.json"