CVE-2022-29258

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

XWiki Platform Filter UI provides a generic user interface to convert from a XWiki Filter input stream to an output stream with settings for each stream. Starting with versions 6.0-milestone-2 and 5.4.4 and prior to versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3, XWiki Platform Filter UI contains a possible cross-site scripting vector in the `Filter.FilterStreamDescriptorForm` wiki page related to pretty much all the form fields printed in the home page of the application. The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3. The easiest workaround is to edit the wiki page `Filter.FilterStreamDescriptorForm` (with wiki editor) according to the instructions in the GitHub Security Advisory.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-80CWE-116CWE-79

Affected software

No affected versions have been published.

Timeline

Published
May 31, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-29264.9The Download Manager WordPress plugin before 3.2.55 does not validate one of its settings, which could allow high privilege users such as adCVE-2022-292626.7Improper buffer restrictions in some Intel(R) Server Board BIOS firmware may allow a privileged user to potentially enable escalation of priCVE-2022-292637.8On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prCVE-2022-292649.8An issue was discovered in coreboot 4.13 through 4.16. On APs, arbitrary code execution in SMM may occur.CVE-2022-292657.5Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configuration. The StandardCVE-2022-292667.5In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returnedCVE-2022-292696.5In Nagios XI through 5.8.5, in the schedule report function, an authenticated attacker is able to inject HTML tags that lead to the reformatCVE-2022-29279.8Weak Password Requirements in GitHub repository notrinos/notrinoserp prior to 0.7.CVE-2022-292704.3In Nagios XI through 5.8.5, it is possible for a user without password verification to change his e-mail address.CVE-2022-292716.5In Nagios XI through 5.8.5, a read-only Nagios user (due to an incorrect permission check) is able to schedule downtime for any host/serviceCVE-2022-292726.1In Nagios XI through 5.8.5, an open redirect vulnerability exists in the login function that could lead to spoofing.CVE-2022-292736.1pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters.