CVE-2022-29251: Cross-site Scripting in the Flamingo theme manager
XWiki Platform Flamingo Theme UI is a tool that allows customization and preview of any Flamingo-based skin. Starting with versions 6.2.4 and 6.3-rc-1, a possible cross-site scripting vector is present in the FlamingoThemesCode.WebHomeSheet wiki page related to the "newThemeName" form field. The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3. The easiest available workaround is to edit the wiki page FlamingoThemesCode.WebHomeSheet (with wiki editor) according to the suggestion provided in the GitHub Security Advisory.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-29251?
CVE-2022-29251 has been categorized as a medium severity vulnerability due to the potential for cross-site scripting (XSS).
How do I fix CVE-2022-29251?
To fix CVE-2022-29251, it is recommended to upgrade to XWiki versions 12.10.12 or 13.5.4 and later, which contain the security patch.
What versions of XWiki are affected by CVE-2022-29251?
CVE-2022-29251 affects XWiki versions between 6.2.4 and 12.10.11, as well as versions from 13.0 to 13.4.7 and from 13.5 to 13.10.3.
What type of vulnerability is CVE-2022-29251?
CVE-2022-29251 is a cross-site scripting (XSS) vulnerability that can be exploited via the FlamingoThemesCode.WebHomeSheet wiki page.
Is there a workaround for CVE-2022-29251?
Currently, the best approach for CVE-2022-29251 is to apply the available software updates, as no official workaround is provided.