XWiki Improper Neutralization of Directives in Dynamically Evaluated Code (Eval Injection) Vulnerability - CVE-2022-41928 - Vulnerability Database

XWiki Improper Neutralization of Directives in Dynamically Evaluated Code (Eval Injection) Vulnerability - CVE-2022-41928

High

Reference: CVE-2022-41928

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2022-41928

Title: XWiki Improper Neutralization of Directives in Dynamically Evaluated Code (Eval Injection) Vulnerability

Overview:

XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code (39Eval Injection39) in AttachmentSelector.xml. The issue can also be reproduced by inserting the dangerous payload in the height or alt macro properties. This has been patched in versions 13.10.7 14.4.2 and 14.5. The issue can be fixed on a running wiki by updating XWiki.AttachmentSelector with the versions below: - 14.5-rc-1: https://github.com/xwiki/xwiki-platform/commit/eb15147adf94bddb92626f862c1710d45bcd64a7diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 - 14.4.2: https://github.com/xwiki/xwiki-platform/commit/c02f8eb1f3c953d124f2c097021536f8bc00fa8ddiff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 - 13.10.7: https://github.com/xwiki/xwiki-platform/commit/efd0df0468d46149ba68b66660b93f31b6318515diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23