Critical severity · published Sep 8, 2022
CVE-2022-36094
XWiki Platform Web Parent POM vulnerable to XSS in the attachment history
9.0
CVSS
64.8%
EPSS
No
On KEV
Description
XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyone viewing the history of an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3RC1. As a workaround, it is possible to replace `viewattachrev.vm`, the entry point for this attack, by a patched version from the patch without updating XWiki.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)64.8% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XW
xwiki-platform · xwiki
>= 1.0, < 13.10.6; >= 14.0, < 14.3-rc-1 · source: vendor
XW
Xwiki · Xwiki
1.0 before 13.10.6; 14.0 before 14.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-36094
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-36094
Patch
https://github.com/xwiki/xwiki-platform/commit/047ce9fa4a7c13f3883438aaf54fc50f287a7e8e
Third Party Advisory
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mxf2-4r22-5hq9
Exploit
https://jira.xwiki.org/browse/XWIKI-19612
More from xwiki-platform
9.8
CVE-2025-24893
Remote code execution as guest via SolrSearchMacros request in xwiki
9.9
CVE-2023-27479
Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-panels-ui
9.8
CVE-2026-33229
XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API
9.8
CVE-2025-54385
XWiki Platform's searchDocuments API allows for SQL injection
9.8
CVE-2025-32429
XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter