Lucene search

GitHub_MCVE-2022-29252

HistoryMay 25, 2022 - 9:15 p.m.

CVE-2022-29252

2022-05-2521:15:08

CWE-116

CWE-80

CWE-79

GitHub_M

web.nvd.nist.gov

xwiki

platform

wiki

main

subwikis

cross-site scripting

cve-2022-29252

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

EPSS

0.001

Percentile

30.8%

JSON

XWiki Platform Wiki UI Main Wiki is a package for managing subwikis. Starting with version 5.3-milestone-2, XWiki Platform Wiki UI Main Wiki contains a possible cross-site scripting vector in the WikiManager.JoinWiki wiki page related to the “requestJoin” field. The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3. The easiest available workaround is to edit the wiki page WikiManager.JoinWiki (with wiki editor) according to the suggestion provided in the GitHub Security Advisory.

Affected configurations

Nvd

Vulners

Node

xwikixwikiRange5.4–12.10.11

xwikixwikiRange13.0–13.4.7

xwikixwikiRange13.5–13.10.3

xwikixwikiMatch5.3milestone2

VendorProductVersionCPE
xwikixwiki*cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
xwikixwiki5.3cpe:2.3:a:xwiki:xwiki:5.3:milestone2:*:*:*:*:*:*

Vendor	Product	Version	CPE
xwiki	xwiki	*	cpe:2.3:a:xwiki:xwiki::::::::
xwiki	xwiki	5.3	cpe:2.3:a:xwiki:xwiki:5.3:milestone2::::::

CNA Affected

[
  {
    "product": "xwiki-platform",
    "vendor": "xwiki",
    "versions": [
      {
        "status": "affected",
        "version": ">= 5.3-milestone-2, < 12.10.11"
      },
      {
        "status": "affected",
        "version": ">= 13.0, < 13.4.7"
      },
      {
        "status": "affected",
        "version": ">= 13.5, < 13.10.3"
      }
    ]
  }
]

References

github.com/xwiki/xwiki-platform/commit/27f839133d41877e538d35fa88274b50a1c00b9b

github.com/xwiki/xwiki-platform/security/advisories/GHSA-ph5x-h23x-7q5q

jira.xwiki.org/browse/XWIKI-19292

Social References

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

EPSS

0.001

Percentile

30.8%

JSON

Related for CVE-2022-29252