CVE-2022-41928: XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml
XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml. The issue can also be reproduced by inserting the dangerous payload in the height or alt macro properties. This has been patched in versions 13.10.7, 14.4.2, and 14.5. The issue can be fixed on a running wiki by updating XWiki.AttachmentSelector with the versions below: - 14.5-rc-1+: https://github.com/xwiki/xwiki-platform/commit/eb15147adf94bddb92626f862c1710d45bcd64a7#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 - 14.4.2+: https://github.com/xwiki/xwiki-platform/commit/c02f8eb1f3c953d124f2c097021536f8bc00fa8d#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 - 13.10.7+: https://github.com/xwiki/xwiki-platform/commit/efd0df0468d46149ba68b66660b93f31b6318515#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
XWiki.AttachmentSelectorto a version that resolves this vulnerability.Fixed in 14.5-rc-1+ - Upgrade
Upgrade
XWiki.AttachmentSelectorto a version that resolves this vulnerability.Fixed in 14.4.2+ - Upgrade
Upgrade
XWiki.AttachmentSelectorto a version that resolves this vulnerability.Fixed in 13.10.7+
Event History
Frequently Asked Questions
What is the severity of CVE-2022-41928?
CVE-2022-41928 has been classified as a high severity vulnerability due to its potential for code execution through eval injection.
How do I fix CVE-2022-41928?
To fix CVE-2022-41928, upgrade to the latest patched version of XWiki that addresses the eval injection issue.
Which versions are affected by CVE-2022-41928?
CVE-2022-41928 affects multiple versions of XWiki, particularly versions from 5.0 to 13.10.7 and 14.0.0 to 14.4.2.
Can CVE-2022-41928 be exploited remotely?
Yes, CVE-2022-41928 can be exploited remotely through malicious payloads inserted into specific macro properties.
What is eval injection in the context of CVE-2022-41928?
Eval injection in the context of CVE-2022-41928 refers to the improper neutralization of directives in dynamically evaluated code, allowing attackers to execute arbitrary code.