CVE-2022-36094

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-36094
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-36094.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-36094
Aliases
Published
2022-09-08T20:10:09Z
Modified
2026-03-13T05:55:25.750896Z
Severity
  • 8.9 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L CVSS Calculator
Summary
XWiki Platform Web Parent POM vulnerable to XSS in the attachment history
Details

XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyone viewing the history of an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3RC1. As a workaround, it is possible to replace viewattachrev.vm, the entry point for this attack, by a patched version from the patch without updating XWiki.

Database specific 
{
    "cwe_ids": [
        "CWE-79",
        "CWE-80"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36094.json"
}
References

Affected packages

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
93d8322eda7b68fd66f33334b982b047d7cf4f36
Fixed
c3f97150d6997ada95d919857fdc9690ed7ed316
Database specific 
{
    "versions": [
        {
            "introduced": "1.0"
        },
        {
            "fixed": "13.10.6"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
d971304b0e0bf4f6dad278de89518edc17459741
Fixed
91aed101530bdacf3cb2f1982f7eec0c17208f7b
Database specific 
{
    "versions": [
        {
            "introduced": "14.0"
        },
        {
            "fixed": "14.3-rc-1"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-36094.json"