CVE-2022-36095

    Dashboard / Vulnerabilities / CVE-2022-36095

    CVE-2022-36095

    Published: 8 Sept 2022Last Modified: 12 Aug 2026

    Summary: XWiki Cross-Site Request Forgery (CSRF) for actions on tags

    Details: XWiki Platform is a generic wiki platform. Prior to versions 13.10.5 and 14.3, it is possible to perform a Cross-Site Request Forgery (CSRF) attack for adding or removing tags on XWiki pages. The problem has been patched in XWiki 13.10.5 and 14.3. As a workaround, one may locally modify the `documentTags.vm` template in one's filesystem, to apply the changes exposed there.

    References: https://jira.xwiki.org/browse/XWIKI-19550, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36095.json, https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-fxwr-4vq9-9vhj, https://nvd.nist.gov/vuln/detail/CVE-2022-36095, https://github.com/xwiki/xwiki-platform/commit/7ca56e40cf79a468cea54d3480b6b403f259f9ae

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -479a47aeb015f634a121f1821642e0cb61dcc3d7

    Affected versions

    2.0-milestone2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-36095 | CVE-DB