CVE-2022-41928: XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml
First published: Wed Nov 23 2022(Updated: )
XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml. The issue can also be reproduced by inserting the dangerous payload in the `height` or `alt` macro properties. This has been patched in versions 13.10.7, 14.4.2, and 14.5. The issue can be fixed on a running wiki by updating `XWiki.AttachmentSelector` with the versions below: - 14.5-rc-1+: https://github.com/xwiki/xwiki-platform/commit/eb15147adf94bddb92626f862c1710d45bcd64a7#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 - 14.4.2+: https://github.com/xwiki/xwiki-platform/commit/c02f8eb1f3c953d124f2c097021536f8bc00fa8d#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 - 13.10.7+: https://github.com/xwiki/xwiki-platform/commit/efd0df0468d46149ba68b66660b93f31b6318515#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Xwiki | >5.0<13.10.7 | |
| Xwiki | >=14.0.0<14.4.2 | |
| Xwiki | =5.0-milestone1 | |
| Xwiki | =5.0-milestone2 | |
| Xwiki | =14.4.3 | |
| Xwiki | =14.4.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-41928?
CVE-2022-41928 has been classified as a high severity vulnerability due to its potential for code execution through eval injection.
How do I fix CVE-2022-41928?
To fix CVE-2022-41928, upgrade to the latest patched version of XWiki that addresses the eval injection issue.
Which versions are affected by CVE-2022-41928?
CVE-2022-41928 affects multiple versions of XWiki, particularly versions from 5.0 to 13.10.7 and 14.0.0 to 14.4.2.
Can CVE-2022-41928 be exploited remotely?
Yes, CVE-2022-41928 can be exploited remotely through malicious payloads inserted into specific macro properties.
What is eval injection in the context of CVE-2022-41928?
Eval injection in the context of CVE-2022-41928 refers to the improper neutralization of directives in dynamically evaluated code, allowing attackers to execute arbitrary code.
- agent/references
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/remedy
- agent/author
- agent/title
- agent/last-modified-date
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/xwiki
- canonical/xwiki
- version/xwiki/14.0.0
- version/xwiki/5.0-milestone1
- version/xwiki/5.0-milestone2
- version/xwiki/14.4.3
- version/xwiki/14.4.4