CVE-2022-36094 in the critical feed json
XWiki Platform Web Parent POM vulnerable to XSS in the attachment history
published 2022-09-08 4 y ago modified 2026-06-17 4 mo ago also GHSA-mxf2-4r22-5hq9 , EUVD-2022-6885
- cvss
- 8.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 64.8%
- EPSS 64.8% chance of exploitation in 30 days, percentile 99.2%
- public exploits
- 0
- none known
Summary
XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyone viewing the history of an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3RC1. As a workaround, it is possible to replace `viewattachrev.vm`, the entry point for this attack, by a patched version from the patch without updating XWiki.
Patch / fix
- maven org.xwiki.platform:xwiki-platform-web 13.10.6, 14.3-rc-1
- xwiki xwiki 13.10.6, 14.3
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 18 mo ago
Exploit prediction
64.79% chance of exploitation in the next 30 days, higher than 99.2% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- jira.xwiki.org https://jira.xwiki.org/browse/XWIKI-19612 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L |
| NVD | 3.1 | 9.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 8.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.xwiki.platform:xwiki-platform-web | >=1.0, <13.10.6 >=14.0, <14.3-rc-1 |
13.10.6 14.3-rc-1 |
Affected products
- xwiki xwiki-platform
Classification
References
-
github.com
/xwiki/xwiki-platform/commit/047ce9fa4a7c13f3883438aaf54fc50f287a7e8e
web, patch, third-party-advisory
-
jira.xwiki.org
/browse/XWIKI-19612
web, exploit, vendor-advisory
-
github.com
/xwiki/xwiki-platform/security/advisories/GHSA-mxf2-4r22-5hq9
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-36094
advisory
-
github.com
/xwiki/xwiki-platform
package
Sources
- CVE List CVE-2022-36094
- GitHub Advisory GHSA-mxf2-4r22-5hq9
- NVD CVE-2022-36094
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.