CVE-2022-36097: XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form
XWiki Platform Attachment UI provides a macro to easily upload and select attachments for XWiki Platform, a generic wiki platform. Starting with version 14.0-rc-1 and prior to 14.4-rc-1, it's possible to store JavaScript in an attachment name, which will be executed by anyone trying to move the corresponding attachment. This issue has been patched in XWiki 14.4-rc-1. As a workaround, one may copy moveStep1.vm to webapp/xwiki/templates/moveStep1.vm and replace vulnerable code with code from the patch.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-36097?
CVE-2022-36097 has been rated as a high severity vulnerability due to the possibility of executing malicious JavaScript code.
How do I fix CVE-2022-36097?
To fix CVE-2022-36097, upgrade to XWiki Platform version 14.4-rc-1 or later.
What versions of XWiki are affected by CVE-2022-36097?
CVE-2022-36097 affects XWiki Platform versions from 14.0-rc-1 to 14.3.
What are the implications of CVE-2022-36097?
The implications of CVE-2022-36097 include potential unauthorized JavaScript execution, leading to security breaches.
Is there a workaround for CVE-2022-36097?
Currently, there is no documented workaround for CVE-2022-36097 other than upgrading to a fixed version.