GHSA-fxwr-4vq9-9vhj

Source

https://github.com/advisories/GHSA-fxwr-4vq9-9vhj

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-fxwr-4vq9-9vhj/GHSA-fxwr-4vq9-9vhj.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fxwr-4vq9-9vhj

Aliases

CVE-2022-36095

Published

2022-09-16T21:04:25Z

Modified

2023-11-08T04:10:00.740524Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS Calculator

Summary

XWiki Cross-Site Request Forgery (CSRF) for actions on tags

Details

Impact

It's possible to perform a CSRF attack for adding or removing tags on XWiki pages.

Patches

The problem has been patched in XWiki 13.10.5 and 14.3.

Workarounds

It's possible to fix the issue without upgrading by locally modifying the documentTags.vm template in your filesystem, to apply the changes exposed there: https://github.com/xwiki/xwiki-platform/commit/7ca56e40cf79a468cea54d3480b6b403f259f9ae.

References

https://jira.xwiki.org/browse/XWIKI-19550

For more information

If you have any questions or comments about this advisory: * Open an issue in Jira XWiki * Email us at security ML

Database specific

{
    "nvd_published_at": "2022-09-08T21:15:00Z",
    "github_reviewed_at": "2022-09-16T21:04:25Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-352"
    ]
}

References

Affected packages

Maven / org.xwiki.platform:xwiki-platform-web-templates

Package

Name: org.xwiki.platform:xwiki-platform-web-templates; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-web-templates

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0-milestone-1

Fixed

13.10.5

Maven / org.xwiki.platform:xwiki-platform-web-templates

Package

Name: org.xwiki.platform:xwiki-platform-web-templates; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-web-templates

Affected ranges

Type: ECOSYSTEM
Events: Introduced

14.0

Fixed

14.3