CVE-2022-36095: Cross-Site Request Forgery (CSRF)

September 16, 2022

XWiki Platform is a generic wiki platform. Prior to versions 13.10.5 and 14.3, it is possible to perform a Cross-Site Request Forgery (CSRF) attack for adding or removing tags on XWiki pages. The problem has been patched in XWiki 13.10.5 and 14.3. As a workaround, one may locally modify the documentTags.vm template in one’s filesystem, to apply the changes exposed there.

References

github.com/advisories/GHSA-fxwr-4vq9-9vhj
github.com/xwiki/xwiki-platform/commit/7ca56e40cf79a468cea54d3480b6b403f259f9ae
github.com/xwiki/xwiki-platform/security/advisories/GHSA-fxwr-4vq9-9vhj
jira.xwiki.org/browse/XWIKI-19550
nvd.nist.gov/vuln/detail/CVE-2022-36095

Code Behaviors & Features

Detect and mitigate CVE-2022-36095 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →