xwiki · xwiki-platform
The XWiki Platform Mentions UI component of the xwiki-platform product fails to sanitise input in mention, macro anchor, and reference fields, allowing stored cross-site scripting. An attacker with low-privileged authenticated access can store JavaScript or Groovy scripts in one of these fields, which then execute for any user who views the page containing the mention, and this requires user interaction (the victim visiting the page) and affects releases from 12.5-rc-1 up to but not including 13.10.6 and 14.4.
XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a mention, macro anchor, or reference field. The stored code is executed by anyone visiting the page with the mention. This issue has been patched on XWiki 14.4 and 13.10.6. As a workaround, one may update `XWiki.Mentions.MentionsMacro` and edit the `Macro code` field of the `XWiki.WikiMacroClass` XObject.
Disclosed on 8 Sep 2022. No public exploit code or confirmed exploitation is recorded.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: org.xwiki.platform:xwiki-platform-mentions-ui.
Upgrade to 14.4 or later
Set the version to 14.4 or later in your pom.xml or build.gradle.
The first fix for CVE-2022-36098. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| 14.0 up to 14.4 | 14.4 |
| 12.5-rc-1 up to 13.10.6 | 13.10.6 |
“Up to” means the second version is the fix and is not affected.