CVE-2022-36094

CriticalCVSS 9.0/10Last modified Jun 17, 2026

Description

XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyone viewing the history of an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3RC1. As a workaround, it is possible to replace `viewattachrev.vm`, the entry point for this attack, by a patched version from the patch without updating XWiki.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79CWE-80

Affected software

No affected versions have been published.

Timeline

Published
Sep 8, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-360954.3XWiki Platform is a generic wiki platform. Prior to versions 13.10.5 and 14.3, it is possible to perform a Cross-Site Request Forgery (CSRF)CVE-2022-360969.0The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wCVE-2022-360976.1XWiki Platform Attachment UI provides a macro to easily upload and select attachments for XWiki Platform, a generic wiki platform. Starting CVE-2022-360989.0XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting inCVE-2022-360998.8XWiki Platform Wiki UI Main Wiki is software for managing subwikis on XWiki Platform, a generic wiki platform. Starting with version 5.3-milCVE-2022-36104.8The Jeeng Push Notifications WordPress plugin before 2.0.4 does not sanitise and escape some of its settings, which could allow high privileCVE-2022-361008.8XWiki Platform Applications Tag and XWiki Platform Tag UI are tag applications for XWiki, a generic wiki platform. Starting with version 1.7CVE-2022-361015.3Shopware is an open source e-commerce software. In affected versions the request for the customer detail view in the backend administration CVE-2022-361027.2Shopware is an open source e-commerce software. In affected versions if backend admin controllers are called with a certain notation, the ACCVE-2022-361038.8Talos Linux is a Linux distribution built for Kubernetes deployments. Talos worker nodes use a join token to get accepted into the Talos cluCVE-2022-361047.5TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-eCVE-2022-361055.3TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that observing response t