GHSA-fxwr-4vq9-9vhj

Suggest an improvement
Source
https://github.com/advisories/GHSA-fxwr-4vq9-9vhj
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-fxwr-4vq9-9vhj/GHSA-fxwr-4vq9-9vhj.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-fxwr-4vq9-9vhj
Aliases
Published
2022-09-16T21:04:25Z
Modified
2023-11-01T04:59:31.520274Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
Summary
XWiki Cross-Site Request Forgery (CSRF) for actions on tags
Details

Impact

It's possible to perform a CSRF attack for adding or removing tags on XWiki pages.

Patches

The problem has been patched in XWiki 13.10.5 and 14.3.

Workarounds

It's possible to fix the issue without upgrading by locally modifying the documentTags.vm template in your filesystem, to apply the changes exposed there: https://github.com/xwiki/xwiki-platform/commit/7ca56e40cf79a468cea54d3480b6b403f259f9ae.

References

https://jira.xwiki.org/browse/XWIKI-19550

For more information

If you have any questions or comments about this advisory: * Open an issue in Jira XWiki * Email us at security ML

Database specific
{
    "nvd_published_at": "2022-09-08T21:15:00Z",
    "github_reviewed_at": "2022-09-16T21:04:25Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-352"
    ]
}
References

Affected packages

Maven / org.xwiki.platform:xwiki-platform-web-templates

Package

Name
org.xwiki.platform:xwiki-platform-web-templates
View open source insights on deps.dev
Purl
pkg:maven/org.xwiki.platform/xwiki-platform-web-templates

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0-milestone-1
Fixed
13.10.5

Maven / org.xwiki.platform:xwiki-platform-web-templates

Package

Name
org.xwiki.platform:xwiki-platform-web-templates
View open source insights on deps.dev
Purl
pkg:maven/org.xwiki.platform/xwiki-platform-web-templates

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14.0
Fixed
14.3