CVE-2022-36096
Description
The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wiki platform. Prior to versions 13.10.6 and 14.3, it's possible to store JavaScript which will be executed by anyone viewing the deleted attachments index with an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3. As a workaround, modify fix the vulnerability by editing the wiki page `XWiki.DeletedAttachments` with the object editor, open the `JavaScriptExtension` object and apply on the content the changes that can be found on the fix commit.
How to fix
- xwiki xwiki13.10.6, 14.3 or later
- org.xwiki.platform:xwiki-platform-index-ui13.10.6, 14.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xwiki xwiki | 2.3 ≤ v < 13.10.6, 14.0 ≤ v < 14.3, 2.2 | 13.10.6, 14.3 |
| org.xwiki.platform:xwiki-platform-index-uiMaven | 2.2-milestone-1 ≤ v < 13.10.6, 14.0 ≤ v < 14.3 | 13.10.6, 14.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.