What is the severity of CVE-2022-36094?

CVE-2022-36094 is considered a high severity vulnerability due to the potential for stored cross-site scripting (XSS) attacks.

How do I fix CVE-2022-36094?

To address CVE-2022-36094, upgrade to XWiki version 13.10.6 or 14.30-rc-1 or later.

What types of applications are affected by CVE-2022-36094?

CVE-2022-36094 affects the XWiki platform, specifically versions from 1.0 up to 13.10.6 and from 14.0 up to 14.3.

What is the impact of CVE-2022-36094?

The impact of CVE-2022-36094 includes the execution of malicious JavaScript when users view attachment history.

Who is responsible for addressing CVE-2022-36094?

It is the responsibility of users and administrators of XWiki to apply the necessary updates to mitigate CVE-2022-36094.

Vulnerability/
CVE-2022-36094

critical

CWE

79 80

8/9/2022

3/8/2024

CVE-2022-36094: XWiki Platform Web Parent POM vulnerable to XSS in the attachment history

First published: Thu Sep 08 2022(Updated: )

XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyone viewing the history of an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3RC1. As a workaround, it is possible to replace `viewattachrev.vm`, the entry point for this attack, by a patched version from the patch without updating XWiki.

Credit: security-advisories@github.com

Affected Software	Affected Version	How to fix
Xwiki	>=1.0<13.10.6
Xwiki	>=14.0<14.3

Remedy

https://github.com/xwiki/xwiki-platform/commit/047ce9fa4a7c13f3883438aaf54fc50f287a7e8e

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2022-36094?
CVE-2022-36094 is considered a high severity vulnerability due to the potential for stored cross-site scripting (XSS) attacks.
How do I fix CVE-2022-36094?
To address CVE-2022-36094, upgrade to XWiki version 13.10.6 or 14.30-rc-1 or later.
What types of applications are affected by CVE-2022-36094?
CVE-2022-36094 affects the XWiki platform, specifically versions from 1.0 up to 13.10.6 and from 14.0 up to 14.3.
What is the impact of CVE-2022-36094?
The impact of CVE-2022-36094 includes the execution of malicious JavaScript when users view attachment history.
Who is responsible for addressing CVE-2022-36094?
It is the responsibility of users and administrators of XWiki to apply the necessary updates to mitigate CVE-2022-36094.

agent/type
collector/mitre-cve
source/MITRE
agent/severity
agent/remedy
agent/last-modified-date
agent/references
agent/title
agent/weakness
agent/author
agent/description
agent/first-publish-date
agent/event
agent/source
agent/tags
collector/nvd-index
agent/software-canonical-lookup-request
agent/softwarecombine
vendor/xwiki
canonical/xwiki
version/xwiki/1.0
version/xwiki/14.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.