CVE-2022-29253

LowCVSS 2.7/10Last modified Jun 17, 2026

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with version 8.3-rc-1 and prior to versions 12.10.3 and 14.0, one can ask for any file located in the classloader using the template API and a path with ".." in it. The issue is patched in versions 14.0 and 13.10.3. There is no easy workaround for this issue.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22CWE-24

Affected software

No affected versions have been published.

Timeline

Published
May 25, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-292546.5silverstripe-omnipay is a SilverStripe integration with Omnipay PHP payments library. For a subset of Omnipay gateways (those that use interCVE-2022-292557.5Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contractCVE-2022-292566.7sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only aCVE-2022-292577.2Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prCVE-2022-292586.1XWiki Platform Filter UI provides a generic user interface to convert from a XWiki Filter input stream to an output stream with settings forCVE-2022-29264.9The Download Manager WordPress plugin before 3.2.55 does not validate one of its settings, which could allow high privilege users such as adCVE-2022-292626.7Improper buffer restrictions in some Intel(R) Server Board BIOS firmware may allow a privileged user to potentially enable escalation of priCVE-2022-292637.8On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prCVE-2022-292649.8An issue was discovered in coreboot 4.13 through 4.16. On APs, arbitrary code execution in SMM may occur.CVE-2022-292657.5Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configuration. The StandardCVE-2022-292667.5In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returnedCVE-2022-292696.5In Nagios XI through 5.8.5, in the schedule report function, an authenticated attacker is able to inject HTML tags that lead to the reformat
CVE-2022-29253: Low severity, CVSS 2.7 | Vulnix