Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
XWiki Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2022-36094 - Vulnerability Database
XWikiplatform

XWiki Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2022-36094

Critical
Reference: CVE-2022-36094
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2022-36094
Title: XWiki Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Overview:

XWiki Platform Web Parent POM contains Web resources for the XWiki platform a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1 it39s possible to store JavaScript which will be executed by anyone viewing the history of an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3RC1. As a workaround it is possible to replace viewattachrev.vm the entry point for this attack by a patched version from the patch without updating XWiki.