{"id":"CVE-2022-36098","published":"2022-09-08T20:50:11Z","modified":"2025-04-22T17:22:36Z","title":"XWiki Platform Mentions UI vulnerable to Cross-site Scripting","vendor":"xwiki","product":"xwiki-platform","tier":"core","eol":null,"affectedVersions":[{"vendor":"xwiki","product":"xwiki-platform","versions":[">= 12.5-rc-1, < 13.10.6",">= 14.0, < 14.4"]}],"description":{"text":"XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a mention, macro anchor, or reference field. The stored code is executed by anyone visiting the page with the mention. This issue has been patched on XWiki 14.4 and 13.10.6. As a workaround, one may update `XWiki.Mentions.MentionsMacro` and edit the `Macro code` field of the `XWiki.WikiMacroClass` XObject.","provenance":"source","from":"CVE.org"},"summary":{"text":"The XWiki Platform Mentions UI component of the xwiki-platform product fails to sanitise input in mention, macro anchor, and reference fields, allowing stored cross-site scripting. An attacker with low-privileged authenticated access can store JavaScript or Groovy scripts in one of these fields, which then execute for any user who views the page containing the mention, and this requires user interaction (the victim visiting the page) and affects releases from 12.5-rc-1 up to but not including 13.10.6 and 14.4.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:15:18Z"},"cvss":{"score":8.9,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.71607,"percentile":0.99419,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5v8-2q4r-5w9v","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459#diff-4fe22885f772e47d3561a05348f73921669ec12d4413b220383b73c7ae484bc4R608-R610","tags":["x_refsource_MISC"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb","tags":["x_refsource_MISC"]},{"url":"https://jira.xwiki.org/browse/XWIKI-19752","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-mentions-ui","vulnerableRanges":[">=12.5-rc-1, <13.10.6",">=14.0, <14.4"],"patched":["13.10.6","14.4"],"from":["GHSA-c5v8-2q4r-5w9v"],"provenance":"source"}],"advisories":[{"id":"GHSA-c5v8-2q4r-5w9v","url":"https://github.com/advisories/GHSA-c5v8-2q4r-5w9v","severity":"CRITICAL","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-mentions-ui","vulnerableRanges":[">=12.5-rc-1, <13.10.6"],"patched":["13.10.6"],"provenance":"source","from":"GHSA"},{"id":"GHSA-c5v8-2q4r-5w9v","url":"https://github.com/advisories/GHSA-c5v8-2q4r-5w9v","severity":"CRITICAL","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-mentions-ui","vulnerableRanges":[">=14.0, <14.4"],"patched":["14.4"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-6775","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6775","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-09-08","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-36098","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":26.1,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.88,"detail":"percentile 0.9942"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.23,"detail":"base score 8.9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}