Lucene search

GitHub_MCVE-2022-29251

HistoryMay 25, 2022 - 9:15 p.m.

CVE-2022-29251

2022-05-2521:15:08

CWE-116

CWE-80

CWE-79

GitHub_M

web.nvd.nist.gov

cve-2022-29251

xwiki

flamingo theme

xss

vulnerability

security

patch

workaround

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

EPSS

0.001

Percentile

30.8%

JSON

XWiki Platform Flamingo Theme UI is a tool that allows customization and preview of any Flamingo-based skin. Starting with versions 6.2.4 and 6.3-rc-1, a possible cross-site scripting vector is present in the FlamingoThemesCode.WebHomeSheet wiki page related to the “newThemeName” form field. The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3. The easiest available workaround is to edit the wiki page FlamingoThemesCode.WebHomeSheet (with wiki editor) according to the suggestion provided in the GitHub Security Advisory.

Affected configurations

Nvd

Vulners

Node

xwikixwikiRange6.2.4–12.10.11

xwikixwikiRange13.0–13.4.7

xwikixwikiRange13.5–13.10.3

VendorProductVersionCPE
xwikixwiki*cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
xwiki	xwiki	*	cpe:2.3:a:xwiki:xwiki::::::::

CNA Affected

[
  {
    "product": "xwiki-platform",
    "vendor": "xwiki",
    "versions": [
      {
        "status": "affected",
        "version": ">= 6.2.4, < 12.10.11"
      },
      {
        "status": "affected",
        "version": ">= 13.0, < 13.4.7"
      },
      {
        "status": "affected",
        "version": ">= 13.5, < 13.10.3"
      }
    ]
  }
]

References

github.com/xwiki/xwiki-platform/commit/bd935320bee3c27cf7548351b1d0f935f116d437

github.com/xwiki/xwiki-platform/security/advisories/GHSA-vmhh-xh3g-j992

jira.xwiki.org/browse/XWIKI-19294

Social References

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

EPSS

0.001

Percentile

30.8%

JSON

Related for CVE-2022-29251