CVE-2022-36096 in the critical feed json
XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list
published 2022-09-08 4 y ago modified 2026-06-17 4 mo ago also GHSA-gjmq-x5x7-wc36 , EUVD-2022-6824
- cvss
- 8.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 60.2%
- EPSS 60.2% chance of exploitation in 30 days, percentile 99.1%
- public exploits
- 0
- none known
Summary
The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wiki platform. Prior to versions 13.10.6 and 14.3, it's possible to store JavaScript which will be executed by anyone viewing the deleted attachments index with an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3. As a workaround, modify fix the vulnerability by editing the wiki page `XWiki.DeletedAttachments` with the object editor, open the `JavaScriptExtension` object and apply on the content the changes that can be found on the fix commit.
Patch / fix
- maven org.xwiki.platform:xwiki-platform-index-ui 13.10.6, 14.3
- xwiki xwiki 13.10.6, 14.3
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 18 mo ago
Exploit prediction
60.22% chance of exploitation in the next 30 days, higher than 99.1% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L |
| NVD | 3.1 | 9.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 8.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.xwiki.platform:xwiki-platform-index-ui | >=2.2-milestone-1, <13.10.6 >=14.0, <14.3 |
13.10.6 14.3 |
Affected products
- xwiki xwiki-platform
Classification
References
-
github.com
/xwiki/xwiki-platform/commit/6705b0cd0289d1c90ed354bd4ecc1508c4b25745
web, patch, third-party-advisory
-
jira.xwiki.org
/browse/XWIKI-19613
web, vendor-advisory
-
github.com
/xwiki/xwiki-platform/security/advisories/GHSA-gjmq-x5x7-wc36
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-36096
advisory
-
github.com
/xwiki/xwiki-platform
package
Sources
- CVE List CVE-2022-36096
- GitHub Advisory GHSA-gjmq-x5x7-wc36
- NVD CVE-2022-36096
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.