CVE-2022-41934: Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-menu-ui

Published Nov 23, 2022
·
Updated

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights on commonly accessible documents including the menu macro can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation due to improper escaping of the macro content and parameters of the menu macro. The problem has been patched in XWiki 14.6RC1, 13.10.8 and 14.4.3. The patch (commit 2fc20891) for the document Menu.MenuMacro can be manually applied or a XAR archive of a patched version can be imported. The menu macro was basically unchanged since XWiki 11.6 so on XWiki 11.6 or later the patch for version of 13.10.8 (commit 59ccca24a) can most likely be applied, on XWiki version 14.0 and later the versions in XWiki 14.6 and 14.4.3 should be appropriate.

Affected Software

4 affected components
XWiki xwiki<13.10.8
XWiki xwiki>=14.0.0<14.4.3
XWiki xwiki=14.4.4
XWiki xwiki=14.4.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade XWiki menu macro (Menu.MenuMacro) to a version that resolves this vulnerability.

    Fixed in 13.10.8Patch 59ccca24a
  2. Upgrade

    Upgrade XWiki menu macro (Menu.MenuMacro) to a version that resolves this vulnerability.

    Fixed in 14.4.3
  3. Upgrade

    Upgrade XWiki menu macro (Menu.MenuMacro) to a version that resolves this vulnerability.

    Fixed in 14.6RC1
  4. Upgrade

    Upgrade XWiki menu macro (Menu.MenuMacro) to a version that resolves this vulnerability.

    Patch 2fc20891

Event History

Nov 23, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2022-41934?

CVE-2022-41934 has a high severity level due to its potential to allow execution of arbitrary code.

2

How do I fix CVE-2022-41934?

To fix CVE-2022-41934, upgrade to a version of XWiki that is not vulnerable, specifically versions 14.4.6 or later.

3

Who is affected by CVE-2022-41934?

CVE-2022-41934 affects users of XWiki versions prior to 14.4.6 and certain mid-range versions.

4

What type of code can be executed through CVE-2022-41934?

CVE-2022-41934 allows the execution of arbitrary Groovy, Python, or Velocity code.

5

What permissions are needed to exploit CVE-2022-41934?

A user only needs view rights on commonly accessible documents to exploit CVE-2022-41934.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203