CVE-2022-36098: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it’s possible to store Javascript or groovy scripts in a mention, macro anchor, or reference field. The stored code is executed by anyone visiting the page with the mention. This issue has been patched on XWiki 14.4 and 13.10.6. As a workaround, one may update XWiki.Mentions.MentionsMacro and edit the Macro code field of the XWiki.WikiMacroClass XObject.
References
- github.com/advisories/GHSA-c5v8-2q4r-5w9v
- github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459
- github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb
- github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5v8-2q4r-5w9v
- jira.xwiki.org/browse/XWIKI-19752
- nvd.nist.gov/vuln/detail/CVE-2022-36098
Code Behaviors & Features
Detect and mitigate CVE-2022-36098 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →