CVE-2022-29251
- Source
- https://cve.org/CVERecord?id=CVE-2022-29251
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-29251.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2022-29251
- Aliases
- Published
- 2022-05-25T20:55:22Z
- Modified
- 2026-02-10T17:00:30.694298Z
- Severity
-
- 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N CVSS Calculator
- Summary
- Cross-site Scripting in the Flamingo theme manager
- Details
-
XWiki Platform Flamingo Theme UI is a tool that allows customization and preview of any Flamingo-based skin. Starting with versions 6.2.4 and 6.3-rc-1, a possible cross-site scripting vector is present in the
FlamingoThemesCode.WebHomeSheetwiki page related to the "newThemeName" form field. The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3. The easiest available workaround is to edit the wiki pageFlamingoThemesCode.WebHomeSheet(with wiki editor) according to the suggestion provided in the GitHub Security Advisory. - Database specific
{ "cwe_ids": [ "CWE-116", "CWE-80" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29251.json", "cna_assigner": "GitHub_M" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29251.json
- https://github.com/xwiki/xwiki-platform/commit/bd935320bee3c27cf7548351b1d0f935f116d437
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vmhh-xh3g-j992
- https://jira.xwiki.org/browse/XWIKI-19294
- https://nvd.nist.gov/vuln/detail/CVE-2022-29251