CVE-2021-43841 json
XSS by SVG upload in xwiki-platform
published 2022-02-04 4 y ago modified 2026-07-08 4 mo ago also GHSA-9jq9-c2cv-pcrj , EUVD-2022-0941
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 59%
- public exploits
- 0
- none known
Summary
XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that the default configuration doesn't allow to display the SVG files in the browser. Users are advised to update or to disallow uploads of SVG files.
Patch / fix
- maven org.xwiki.platform:xwiki-platform-oldcore 12.10.6, 13.3RC1
- maven org.xwiki.platform:xwiki-platform-tool-configuration-resources 12.10.6, 13.3RC1
- xwiki xwiki 12.10.6
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.87% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- jira.xwiki.org https://jira.xwiki.org/browse/XWIKI-18368 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N |
| GitHub | 3.1 | 4.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.xwiki.platform:xwiki-platform-oldcore | <12.10.6 >=13.0, <13.3RC1 |
12.10.6 13.3RC1 |
| maven | org.xwiki.platform:xwiki-platform-tool-configuration-resources | >=13.0, <13.3RC1 <12.10.6 |
13.3RC1 12.10.6 |
Affected products
- xwiki xwiki-platform
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/xwiki/xwiki-platform/commit/5853d492b3a274db0d94d560e2a5ea988a271c62
web, patch, third-party-advisory
-
jira.xwiki.org
/browse/XWIKI-18368
web, exploit, patch, vendor-advisory
-
xwiki.org
/xwiki/bin/view/Documentation/AdminGuide/Attachments#HAttachmentdisplayordownload
web, vendor-advisory
-
github.com
/xwiki/xwiki-platform/security/advisories/GHSA-9jq9-c2cv-pcrj
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-43841
advisory
-
github.com
/xwiki/xwiki-platform
web
Sources
- CVE List CVE-2021-43841
- GitHub Advisory GHSA-9jq9-c2cv-pcrj
- NVD CVE-2021-43841
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.