CVE-2022-29251

    Dashboard / Vulnerabilities / CVE-2022-29251

    CVE-2022-29251

    Published: 25 May 2022Last Modified: 12 Aug 2026

    Summary: Cross-site Scripting in the Flamingo theme manager

    Details: XWiki Platform Flamingo Theme UI is a tool that allows customization and preview of any Flamingo-based skin. Starting with versions 6.2.4 and 6.3-rc-1, a possible cross-site scripting vector is present in the `FlamingoThemesCode.WebHomeSheet` wiki page related to the "newThemeName" form field. The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3. The easiest available workaround is to edit the wiki page `FlamingoThemesCode.WebHomeSheet` (with wiki editor) according to the suggestion provided in the GitHub Security Advisory.

    References: https://jira.xwiki.org/browse/XWIKI-19294, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29251.json, https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vmhh-xh3g-j992, https://nvd.nist.gov/vuln/detail/CVE-2022-29251, https://github.com/xwiki/xwiki-platform/commit/bd935320bee3c27cf7548351b1d0f935f116d437

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- db112373baaa268c5a441c285a5244df194683c6
    Fixed -75e8654651969f3f8c27a7747939b1ce1a3a3422

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-29251 | CVE-DB