{"id":"CVE-2022-41927","published":"2022-11-23T00:00:00Z","modified":"2025-04-23T16:35:31Z","title":"XWiki Platform vulnerable to Cross-Site Request Forgery (CSRF) allowing to delete or rename tags","vendor":"xwiki","product":"xwiki-platform","tier":"tail","description":{"text":"XWiki Platform is vulnerable to Cross-Site Request Forgery (CSRF) that may allow attackers to delete or rename tags without needing any confirmation. The problem has been patched in XWiki 13.10.7, 14.4.1 and 14.5RC1. Workarounds: It's possible to patch existing instances directly by editing the page Main.Tags and add this kind of check, in the code for renaming and for deleting: ``` #if (!$services.csrf.isTokenValid($request.get('form_token'))) #set ($discard = $response.sendError(401, \"Wrong CSRF token\")) #end ```","provenance":"source","from":"CVE.org"},"cvss":{"score":7.4,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00313,"percentile":0.24219,"provenance":"source"},"cwes":[{"id":"CWE-352","name":"Cross-Site Request Forgery"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mq7h-5574-hw9f","tags":[]},{"url":"https://github.com/xwiki/xwiki-platform/commit/7fd4cda0590180c4d34f557597e9e10e263def9e","tags":[]}],"priority":{"score":10.0,"factors":[{"name":"EPSS percentile","points":4.84},{"name":"CVSS severity","points":5.18}]},"vendorSlug":"xwiki","affectedVersions":[{"vendor":"xwiki","product":"xwiki-platform","versions":[">= 3.2-milestone-2, < 13.10.7",">= 14.0.0, < 14.4.1"]}],"affected":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-tag-ui","vulnerableRanges":[">=3.2-milestone-2, <13.10.7",">=14.0.0, <14.4.1"],"patched":["13.10.7","14.4.1"],"from":["GHSA-mq7h-5574-hw9f"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-7387","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2022-36100","published":"2022-09-08","fixed":"14.4","kev":false,"link":{"from":"CVE-2022-36100","to":"CVE-2022-41927","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-tag-ui","fromFixed":"13.10.6","toFixed":"13.10.7","daysApart":76},{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-tag-ui","fromFixed":"14.4","toFixed":"14.4.1","daysApart":76}]}},{"cve":"CVE-2022-41927","published":"2022-11-23","fixed":"14.4.1","kev":false}],"package":"Maven:org.xwiki.platform:xwiki-platform-tag-ui"}}