CVE-2022-41928

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml. The issue can also be reproduced by inserting the dangerous payload in the `height` or `alt` macro properties. This has been patched in versions 13.10.7, 14.4.2, and 14.5. The issue can be fixed on a running wiki by updating `XWiki.AttachmentSelector` with the versions below: - 14.5-rc-1+: https://github.com/xwiki/xwiki-platform/commit/eb15147adf94bddb92626f862c1710d45bcd64a7#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 - 14.4.2+: https://github.com/xwiki/xwiki-platform/commit/c02f8eb1f3c953d124f2c097021536f8bc00fa8d#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 - 13.10.7+: https://github.com/xwiki/xwiki-platform/commit/efd0df0468d46149ba68b66660b93f31b6318515#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-95

Affected software

Vendor	Product	Versions
xwiki	xwiki-platform	>= 5.0-milestone-1, < 13.10.7; >= 14.0.0, < 14.4.2

References

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9hqh-fmhg-vq2jExploit, Patch, Third Party Advisory
https://jira.xwiki.org/browse/XWIKI-19800Exploit, Issue Tracking, Vendor Advisory
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9hqh-fmhg-vq2jExploit, Patch, Third Party Advisory
https://jira.xwiki.org/browse/XWIKI-19800Exploit, Issue Tracking, Vendor Advisory

Timeline

Published: Nov 23, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-419294.9org.xwiki.platform:xwiki-platform-oldcore is missing authorization in User#setDisabledStatus, which may allow an incorrectly authorized user CVE-2022-41938.8Insufficient policy enforcement in File System API in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass file system r CVE-2022-419308.2org.xwiki.platform:xwiki-platform-user-profile-ui is missing authorization to enable or disable users. Any user (logged in or not) with acce CVE-2022-419318.8xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'). Any user wit CVE-2022-419325.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make XWiki create CVE-2022-419336.5XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When the `reset a forgotten passwor CVE-2022-419348.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights on common CVE-2022-419354.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users without the right to view doc CVE-2022-419367.5XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The `modifications` rest endpoint d CVE-2022-419378.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The application allows anyone with CVE-2022-419385.4Flarum is an open source discussion platform. Flarum's page title system allowed for page titles to be converted into HTML DOM nodes when pa CVE-2022-419397.4knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a maliciou