{"id":"CVE-2022-36097","published":"2022-09-08T20:35:11Z","modified":"2025-04-22T17:22:54Z","title":"XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form","vendor":"xwiki","product":"xwiki-platform","tier":"core","eol":null,"affectedVersions":[{"vendor":"xwiki","product":"xwiki-platform","versions":[">= 14.0-rc-1, < 14.4-rc-1"]}],"description":{"text":"XWiki Platform Attachment UI provides a macro to easily upload and select attachments for XWiki Platform, a generic wiki platform. Starting with version 14.0-rc-1 and prior to 14.4-rc-1, it's possible to store JavaScript in an attachment name, which will be executed by anyone trying to move the corresponding attachment. This issue has been patched in XWiki 14.4-rc-1. As a workaround, one may copy `moveStep1.vm` to `webapp/xwiki/templates/moveStep1.vm` and replace vulnerable code with code from the patch.","provenance":"source","from":"CVE.org"},"summary":{"text":"The Attachment UI component of XWiki Platform, a generic wiki platform, fails to neutralise JavaScript stored in attachment names within the move attachment form. An attacker with low-privilege access who can upload an attachment can name it with script that runs in the browser of any user who attempts to move that attachment, which requires user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:15:33Z"},"cvss":{"score":8.9,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.58162,"percentile":0.99089,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"},{"id":"CWE-80","name":"Improper Neutralization of Script-Related HTML Tags in a Web Page"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9r9j-57rf-f6vj","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/fbc4bfbae4f6ce8109addb281de86a03acdb9277","tags":["x_refsource_MISC"]},{"url":"https://jira.xwiki.org/browse/XWIKI-19667","tags":["x_refsource_MISC"]},{"url":"https://raw.githubusercontent.com/xwiki/xwiki-platform/xwiki-platform-14.0-rc-1/xwiki-platform-core/xwiki-platform-attachment/xwiki-platform-attachment-api/src/main/resources/templates/attachment/moveStep1.vm","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-attachment-ui","vulnerableRanges":[">=14.0-rc-1, <14.4-rc-1"],"patched":["14.4-rc-1"],"from":["GHSA-9r9j-57rf-f6vj"],"provenance":"source"}],"advisories":[{"id":"GHSA-9r9j-57rf-f6vj","url":"https://github.com/advisories/GHSA-9r9j-57rf-f6vj","severity":"HIGH","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-attachment-ui","vulnerableRanges":[">=14.0-rc-1, <14.4-rc-1"],"patched":["14.4-rc-1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-6764","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6764","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-09-08","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-36097","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":26.0,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.82,"detail":"percentile 0.9909"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.23,"detail":"base score 8.9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2022-36097","published":"2022-09-08","fixed":"14.4-rc-1","kev":false},{"cve":"CVE-2022-41928","published":"2022-11-23","fixed":"14.4.2","kev":false,"link":{"from":"CVE-2022-36097","to":"CVE-2022-41928","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-attachment-ui","fromFixed":"14.4-rc-1","toFixed":"14.4.2","daysApart":76}]}},{"cve":"CVE-2023-29516","published":"2023-04-18","fixed":"14.10.1","kev":false},{"cve":"CVE-2023-29519","published":"2023-04-18","fixed":"14.10.2","kev":false}],"package":"Maven:org.xwiki.platform:xwiki-platform-attachment-ui"}}