CVE-2022-41927: XWiki Platform vulnerable to Cross-Site Request Forgery (CSRF) allowing to delete or rename tags
XWiki Platform is vulnerable to Cross-Site Request Forgery (CSRF) that may allow attackers to delete or rename tags without needing any confirmation. The problem has been patched in XWiki 13.10.7, 14.4.1 and 14.5RC1. Workarounds: It's possible to patch existing instances directly by editing the page Main.Tags and add this kind of check, in the code for renaming and for deleting: #if (!$services.csrf.isTokenValid($request.get('formtoken'))) #set ($discard = $response.sendError(401, "Wrong CSRF token")) #end
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
XWikito a version that resolves this vulnerability.Fixed in 13.10.7 - Upgrade
Upgrade
XWikito a version that resolves this vulnerability.Fixed in 14.4.1 - Upgrade
Upgrade
XWikito a version that resolves this vulnerability.Fixed in 14.5RC1 - Configuration
Patch existing instances by editing the page Main.Tags and add the shown CSRF token validation check in the code paths for renaming and for deleting.
XWiki page/Main.Tags CSRF token validation for renaming and deleting = Add the following check: #if (!$services.csrf.isTokenValid($request.get('form_token'))) #set ($discard = $response.sendError(401, "Wrong CSRF token")) #end
Event History
Frequently Asked Questions
What is the severity of CVE-2022-41927?
The severity of CVE-2022-41927 is high with a severity value of 7.4.
How does CVE-2022-41927 affect XWiki Platform?
CVE-2022-41927 affects XWiki Platform by allowing attackers to delete or rename tags without confirmation through Cross-Site Request Forgery (CSRF).
Which versions of XWiki are affected by CVE-2022-41927?
Versions between 3.2 and 13.10.7 as well as version 14.4 of XWiki are affected by CVE-2022-41927.
How can I fix CVE-2022-41927 on my XWiki instance?
You can fix CVE-2022-41927 on your XWiki instance by updating to versions 13.10.7, 14.4.1, or 14.5RC1.
Are there any workarounds for CVE-2022-41927?
Yes, you can patch existing instances by editing the page directly.