CVE-2022-36095: XWiki Cross-Site Request Forgery (CSRF) for actions on tags
XWiki Platform is a generic wiki platform. Prior to versions 13.10.5 and 14.3, it is possible to perform a Cross-Site Request Forgery (CSRF) attack for adding or removing tags on XWiki pages. The problem has been patched in XWiki 13.10.5 and 14.3. As a workaround, one may locally modify the documentTags.vm template in one's filesystem, to apply the changes exposed there.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-36095?
CVE-2022-36095 is classified as a medium severity vulnerability due to its potential to execute a Cross-Site Request Forgery (CSRF) attack.
How do I fix CVE-2022-36095?
To fix CVE-2022-36095, upgrade XWiki to versions 13.10.5 or 14.3 or later.
What is the impact of CVE-2022-36095 on XWiki pages?
CVE-2022-36095 allows attackers to add or remove tags on XWiki pages through CSRF exploitation.
Which versions of XWiki are affected by CVE-2022-36095?
CVE-2022-36095 affects XWiki versions prior to 13.10.5 and 14.3, including 2.0-milestone2.
Is there a workaround for CVE-2022-36095?
Yes, a local modification can serve as a workaround until the upgrade is applied to resolve CVE-2022-36095.