CVE-2022-36098

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-36098
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-36098.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-36098
Aliases
Published
2022-09-08T20:50:11Z
Modified
2026-02-17T07:40:09.272385Z
Severity
  • 8.9 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L CVSS Calculator
Summary
XWiki Platform Mentions UI vulnerable to Cross-site Scripting
Details

XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a mention, macro anchor, or reference field. The stored code is executed by anyone visiting the page with the mention. This issue has been patched on XWiki 14.4 and 13.10.6. As a workaround, one may update XWiki.Mentions.MentionsMacro and edit the Macro code field of the XWiki.WikiMacroClass XObject.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36098.json"
}
References

Affected packages

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
35cf93c39603e3b476bb3e42a04dfb1059e7fe62
Fixed
c3f97150d6997ada95d919857fdc9690ed7ed316
Database specific 
{
    "versions": [
        {
            "introduced": "12.5-rc-1"
        },
        {
            "fixed": "13.10.6"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
d971304b0e0bf4f6dad278de89518edc17459741
Fixed
5d23a4d1ec341678fa8f1c2ac60d50f0a16f5e3b
Database specific 
{
    "versions": [
        {
            "introduced": "14.0"
        },
        {
            "fixed": "14.4"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-36098.json"