CVE-2022-36096

CriticalCVSS 9.0/10Last modified Jun 17, 2026

Description

The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wiki platform. Prior to versions 13.10.6 and 14.3, it's possible to store JavaScript which will be executed by anyone viewing the deleted attachments index with an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3. As a workaround, modify fix the vulnerability by editing the wiki page `XWiki.DeletedAttachments` with the object editor, open the `JavaScriptExtension` object and apply on the content the changes that can be found on the fix commit.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79CWE-80

Affected software

No affected versions have been published.

Timeline

Published
Sep 8, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-360976.1XWiki Platform Attachment UI provides a macro to easily upload and select attachments for XWiki Platform, a generic wiki platform. Starting CVE-2022-360989.0XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting inCVE-2022-360998.8XWiki Platform Wiki UI Main Wiki is software for managing subwikis on XWiki Platform, a generic wiki platform. Starting with version 5.3-milCVE-2022-36104.8The Jeeng Push Notifications WordPress plugin before 2.0.4 does not sanitise and escape some of its settings, which could allow high privileCVE-2022-361008.8XWiki Platform Applications Tag and XWiki Platform Tag UI are tag applications for XWiki, a generic wiki platform. Starting with version 1.7CVE-2022-361015.3Shopware is an open source e-commerce software. In affected versions the request for the customer detail view in the backend administration CVE-2022-361027.2Shopware is an open source e-commerce software. In affected versions if backend admin controllers are called with a certain notation, the ACCVE-2022-361038.8Talos Linux is a Linux distribution built for Kubernetes deployments. Talos worker nodes use a join token to get accepted into the Talos cluCVE-2022-361047.5TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-eCVE-2022-361055.3TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that observing response tCVE-2022-361065.4TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time CVE-2022-361075.4TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `FileDumpControl