CVE-2022-36098

    Dashboard / Vulnerabilities / CVE-2022-36098

    CVE-2022-36098

    Published: 8 Sept 2022Last Modified: 12 Aug 2026

    Summary: XWiki Platform Mentions UI vulnerable to Cross-site Scripting

    Details: XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a mention, macro anchor, or reference field. The stored code is executed by anyone visiting the page with the mention. This issue has been patched on XWiki 14.4 and 13.10.6. As a workaround, one may update `XWiki.Mentions.MentionsMacro` and edit the `Macro code` field of the `XWiki.WikiMacroClass` XObject.

    References: https://jira.xwiki.org/browse/XWIKI-19752, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36098.json, https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5v8-2q4r-5w9v, https://nvd.nist.gov/vuln/detail/CVE-2022-36098, https://github.com/xwiki/xwiki-platform/commit/4032dc896857597efd169966dc9e2752a9fdd459#diff-4fe22885f772e47d3561a05348f73921669ec12d4413b220383b73c7ae484bc4R608-R610, https://github.com/xwiki/xwiki-platform/commit/4f290d87a8355e967378a1ed6aee23a06ba162eb

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 9c0539e3b1f7a819bfbf4914fc05788308a4f7d0
    Fixed -479a47aeb015f634a121f1821642e0cb61dcc3d7

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-36098 | CVE-DB