What’s Vulnerable › Vulnerabilities

CVE-2022-36094: XWiki Platform Web Parent POM vulnerable to XSS in the attachment history

• Severity: critical (CVSS 9.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 64.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-09-08 · updated 2026-06-17
• Weakness: CWE-79

Description

XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyone viewing the history of an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3RC1. As a workaround, it is possible to replace `viewattachrev.vm`, the entry point for this attack, by a patched version from the patch without updating XWiki.

Affected products

• xwiki-platform: from 1.0 before 13.10.6; from 14.0 before 14.3 — fixed in 13.10.6, 14.3

How to fix

Upgrade to a fixed version: xwiki-platform 13.10.6, 14.3. Check the vendor advisory for mitigations.

References

• https://github.com/xwiki/xwiki-platform/commit/047ce9fa4a7c13f3883438aaf54fc50f287a7e8e
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mxf2-4r22-5hq9
• https://jira.xwiki.org/browse/XWIKI-19612
• https://github.com/xwiki/xwiki-platform/commit/047ce9fa4a7c13f3883438aaf54fc50f287a7e8e
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mxf2-4r22-5hq9
• https://jira.xwiki.org/browse/XWIKI-19612

Get alerted when CVE-2022-36094 or the next vulnerability affects your stack