CVE-2022-41931: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-ui
First published: Wed Nov 23 2022(Updated: )
xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'). Any user with view rights on commonly accessible documents including the icon picker macro can execute arbitrary Groovy, Python or Velocity code in XWiki due to improper neutralization of the macro parameters of the icon picker macro. The problem has been patched in XWiki 13.10.7, 14.5 and 14.4.2. Workarounds: The [patch](https://github.com/xwiki/xwiki-platform/commit/47eb8a5fba550f477944eb6da8ca91b87eaf1d01) can be manually applied by editing `IconThemesCode.IconPickerMacro` in the object editor. The whole document can also be replaced by the current version by importing the document from the XAR archive of a fixed version as the only changes to the document have been security fixes and small formatting changes.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Xwiki | >6.4<13.10.7 | |
| Xwiki | >=14.0.0<14.4.2 | |
| Xwiki | =6.4-milestone2 | |
| Xwiki | =6.4-milestone3 | |
| Xwiki | =14.4.3 | |
| Xwiki | =14.4.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-41931?
CVE-2022-41931 has a medium severity level due to its potential for code execution by authenticated users.
How do I fix CVE-2022-41931?
To fix CVE-2022-41931, update your XWiki installation to a version later than 14.4.4 or implement the recommended patches.
What types of code can be executed due to CVE-2022-41931?
CVE-2022-41931 allows execution of arbitrary Groovy, Python, or Velocity code due to improper neutralization of directives.
Who is affected by CVE-2022-41931?
Any user with view rights on commonly accessible documents, including the icon picker macro, can exploit CVE-2022-41931.
What versions of XWiki are affected by CVE-2022-41931?
CVE-2022-41931 affects XWiki versions from 6.4 up to 14.4.4, including specific milestones and revisions within those ranges.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/author
- agent/last-modified-date
- agent/remedy
- agent/severity
- agent/weakness
- agent/title
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/xwiki
- canonical/xwiki
- version/xwiki/14.0.0
- version/xwiki/6.4-milestone2
- version/xwiki/6.4-milestone3
- version/xwiki/14.4.3
- version/xwiki/14.4.4