CVE-2022-36094

    Dashboard / Vulnerabilities / CVE-2022-36094

    CVE-2022-36094

    Published: 8 Sept 2022Last Modified: 12 Aug 2026

    Summary: XWiki Platform Web Parent POM vulnerable to XSS in the attachment history

    Details: XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyone viewing the history of an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3RC1. As a workaround, it is possible to replace `viewattachrev.vm`, the entry point for this attack, by a patched version from the patch without updating XWiki.

    References: https://jira.xwiki.org/browse/XWIKI-19612, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36094.json, https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mxf2-4r22-5hq9, https://nvd.nist.gov/vuln/detail/CVE-2022-36094, https://github.com/xwiki/xwiki-platform/commit/047ce9fa4a7c13f3883438aaf54fc50f287a7e8e

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -479a47aeb015f634a121f1821642e0cb61dcc3d7

    Affected versions

    xwiki-commons-14.3-rc-1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-36094 | CVE-DB