CVE-2022-36096

CriticalCVSS 9.0/10Last modified Jun 17, 2026

Description

The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wiki platform. Prior to versions 13.10.6 and 14.3, it's possible to store JavaScript which will be executed by anyone viewing the deleted attachments index with an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3. As a workaround, modify fix the vulnerability by editing the wiki page `XWiki.DeletedAttachments` with the object editor, open the `JavaScriptExtension` object and apply on the content the changes that can be found on the fix commit.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79 CWE-80

Affected software

Vendor	Product	Versions
xwiki	xwiki-platform	>= 2.2-milestone-1, < 13.10.6; >= 14.0, < 14.3

References

https://github.com/xwiki/xwiki-platform/commit/6705b0cd0289d1c90ed354bd4ecc1508c4b25745Patch, Third Party Advisory
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gjmq-x5x7-wc36Third Party Advisory
https://jira.xwiki.org/browse/XWIKI-19613Vendor Advisory
https://github.com/xwiki/xwiki-platform/commit/6705b0cd0289d1c90ed354bd4ecc1508c4b25745Patch, Third Party Advisory
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gjmq-x5x7-wc36Third Party Advisory
https://jira.xwiki.org/browse/XWIKI-19613Vendor Advisory

Timeline

Published: Sep 8, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-360976.1XWiki Platform Attachment UI provides a macro to easily upload and select attachments for XWiki Platform, a generic wiki platform. Starting CVE-2022-360989.0XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in CVE-2022-360998.8XWiki Platform Wiki UI Main Wiki is software for managing subwikis on XWiki Platform, a generic wiki platform. Starting with version 5.3-mil CVE-2022-36104.8The Jeeng Push Notifications WordPress plugin before 2.0.4 does not sanitise and escape some of its settings, which could allow high privile CVE-2022-361008.8XWiki Platform Applications Tag and XWiki Platform Tag UI are tag applications for XWiki, a generic wiki platform. Starting with version 1.7 CVE-2022-361015.3Shopware is an open source e-commerce software. In affected versions the request for the customer detail view in the backend administration CVE-2022-361027.2Shopware is an open source e-commerce software. In affected versions if backend admin controllers are called with a certain notation, the AC CVE-2022-361038.8Talos Linux is a Linux distribution built for Kubernetes deployments. Talos worker nodes use a join token to get accepted into the Talos clu CVE-2022-361047.5TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-e CVE-2022-361055.3TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that observing response t CVE-2022-361065.4TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time CVE-2022-361075.4TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `FileDumpControl