CVE-2022-36097: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
XWiki Platform Attachment UI provides a macro to easily upload and select attachments for XWiki Platform, a generic wiki platform. Starting with version 14.0-rc-1 and prior to 14.4-rc-1, it’s possible to store JavaScript in an attachment name, which will be executed by anyone trying to move the corresponding attachment. This issue has been patched in XWiki 14.4-rc-1. As a workaround, one may copy moveStep1.vm to webapp/xwiki/templates/moveStep1.vm and replace vulnerable code with code from the patch.
References
- github.com/advisories/GHSA-9r9j-57rf-f6vj
- github.com/xwiki/xwiki-platform/commit/fbc4bfbae4f6ce8109addb281de86a03acdb9277
- github.com/xwiki/xwiki-platform/security/advisories/GHSA-9r9j-57rf-f6vj
- jira.xwiki.org/browse/XWIKI-19667
- nvd.nist.gov/vuln/detail/CVE-2022-36097
- raw.githubusercontent.com/xwiki/xwiki-platform/xwiki-platform-14.0-rc-1/xwiki-platform-core/xwiki-platform-attachment/xwiki-platform-attachment-api/src/main/resources/templates/attachment/moveStep1.vm
Code Behaviors & Features
Detect and mitigate CVE-2022-36097 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →