CVE-2022-36097

XWiki Platform Attachment UI provides a macro to easily upload and select attachments for XWiki Platform, a generic wiki platform. Starting with version 14.0-rc-1 and prior to 14.4-rc-1, it's possible to store JavaScript in an attachment name, which will be executed by anyone trying to move the corresponding attachment. This issue has been patched in XWiki 14.4-rc-1. As a workaround, one may copy `moveStep1.vm` to `webapp/xwiki/templates/moveStep1.vm` and replace vulnerable code with code from the patch.
Configurations

Configuration 1

cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*

Information

Published : 2022-09-08 09:15

Updated : 2022-09-13 07:40


NVD link : CVE-2022-36097

Mitre link : CVE-2022-36097

Products Affected
No products.
CWE