Lucene search

GitHub_MCVE-2022-29258

HistoryMay 31, 2022 - 5:15 p.m.

CVE-2022-29258

2022-05-3117:15:07

CWE-116

CWE-80

CWE-79

GitHub_M

web.nvd.nist.gov

xwiki

platform

filter

xss

vulnerability

cve-2022-29258

security advisory

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

EPSS

0.001

Percentile

30.8%

JSON

XWiki Platform Filter UI provides a generic user interface to convert from a XWiki Filter input stream to an output stream with settings for each stream. Starting with versions 6.0-milestone-2 and 5.4.4 and prior to versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3, XWiki Platform Filter UI contains a possible cross-site scripting vector in the Filter.FilterStreamDescriptorForm wiki page related to pretty much all the form fields printed in the home page of the application. The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3. The easiest workaround is to edit the wiki page Filter.FilterStreamDescriptorForm (with wiki editor) according to the instructions in the GitHub Security Advisory.

Affected configurations

Nvd

Vulners

Node

xwikixwikiRange5.4.4–12.10.11

xwikixwikiRange13.0–13.4.7

xwikixwikiRange13.5–13.10.3

VendorProductVersionCPE
xwikixwiki*cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
xwiki	xwiki	*	cpe:2.3:a:xwiki:xwiki::::::::

CNA Affected

[
  {
    "product": "xwiki-platform",
    "vendor": "xwiki",
    "versions": [
      {
        "status": "affected",
        "version": ">= 5.4.4, <= 6.0-milestone-2"
      },
      {
        "status": "affected",
        "version": ">= 6.0-milestone-2, < 12.10.11"
      },
      {
        "status": "affected",
        "version": ">= 13.0.0, < 13.4.7"
      },
      {
        "status": "affected",
        "version": ">= 13.5.0, < 13.10.3"
      }
    ]
  }
]

References

github.com/xwiki/xwiki-platform/commit/21906acb5ee2304552f56f9bbdbf8e7d368f7f3a

github.com/xwiki/xwiki-platform/security/advisories/GHSA-xjfw-5vv5-vjq2

jira.xwiki.org/browse/XWIKI-19293

Social References

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

EPSS

0.001

Percentile

30.8%

JSON

Related for CVE-2022-29258