{"id":"CVE-2022-41928","published":"2022-11-23T00:00:00Z","modified":"2025-04-22T16:01:25Z","title":"XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in…","vendor":"xwiki","product":"xwiki-platform","tier":"tail","description":{"text":"XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml. The issue can also be reproduced by inserting the dangerous payload in the `height` or `alt` macro properties. This has been patched in versions 13.10.7, 14.4.2, and 14.5. The issue can be fixed on a running wiki by updating `XWiki.AttachmentSelector` with the versions below: - 14.5-rc-1+: https://github.com/xwiki/xwiki-platform/commit/eb15147adf94bddb92626f862c1710d45bcd64a7#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 - 14.4.2+: https://github.com/xwiki/xwiki-platform/commit/c02f8eb1f3c953d124f2c097021536f8bc00fa8d#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 - 13.10.7+: https://github.com/xwiki/xwiki-platform/commit/efd0df0468d46149ba68b66660b93f31b6318515#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23","provenance":"source","from":"CVE.org"},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01046,"percentile":0.64103,"provenance":"source"},"cwes":[{"id":"CWE-95","name":"Improper Neutralization of Directives in Dynamically Evaluated Code"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9hqh-fmhg-vq2j","tags":[]},{"url":"https://jira.xwiki.org/browse/XWIKI-19800","tags":[]}],"priority":{"score":19.8,"factors":[{"name":"EPSS percentile","points":12.82},{"name":"CVSS severity","points":6.93}]},"vendorSlug":"xwiki","affectedVersions":[{"vendor":"xwiki","product":"xwiki-platform","versions":[">= 5.0-milestone-1, < 13.10.7",">= 14.0.0, < 14.4.2"]}],"affected":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-attachment-ui","vulnerableRanges":[">=5.0-milestone-1, <13.10.7",">=14.0.0, <14.4.2"],"patched":["13.10.7","14.4.2"],"from":["GHSA-9hqh-fmhg-vq2j"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-7304","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2022-36097","published":"2022-09-08","fixed":"14.4-rc-1","kev":false,"link":{"from":"CVE-2022-36097","to":"CVE-2022-41928","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-attachment-ui","fromFixed":"14.4-rc-1","toFixed":"14.4.2","daysApart":76}]}},{"cve":"CVE-2022-41928","published":"2022-11-23","fixed":"14.4.2","kev":false},{"cve":"CVE-2023-29516","published":"2023-04-18","fixed":"14.10.1","kev":false,"link":{"from":"CVE-2022-41928","to":"CVE-2023-29516","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-attachment-ui","fromFixed":"13.10.7","toFixed":"13.10.11","daysApart":146},{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-attachment-ui","fromFixed":"14.4.2","toFixed":"14.4.8","daysApart":146}]}},{"cve":"CVE-2023-29519","published":"2023-04-18","fixed":"14.10.2","kev":false,"link":{"from":"CVE-2022-41928","to":"CVE-2023-29519","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-attachment-ui","fromFixed":"13.10.7","toFixed":"13.10.11","daysApart":146},{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-attachment-ui","fromFixed":"14.4.2","toFixed":"14.4.8","daysApart":146}]}}],"package":"Maven:org.xwiki.platform:xwiki-platform-attachment-ui"}}