CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2022-36095 – XWiki Cross-Site Request Forgery (CSRF) for actions on tags
https://notcve.org/view.php?id=CVE-2022-36095
XWiki Platform is a generic wiki platform. Prior to versions 13.10.5 and 14.3, it is possible to perform a Cross-Site Request Forgery (CSRF) attack for adding or removing tags on XWiki pages. The problem has been patched in XWiki 13.10.5 and 14.3. As a workaround, one may locally modify the `documentTags.vm` template in one's filesystem, to apply the changes exposed there. XWiki Platform es una plataforma wiki genérica. • https://github.com/xwiki/xwiki-platform/commit/7ca56e40cf79a468cea54d3480b6b403f259f9ae https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-fxwr-4vq9-9vhj https://jira.xwiki.org/browse/XWIKI-19550 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2022-36094 – XWiki Platform Web Parent POM vulnerable to XSS in the attachment history
https://notcve.org/view.php?id=CVE-2022-36094
XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyone viewing the history of an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3RC1. As a workaround, it is possible to replace `viewattachrev.vm`, the entry point for this attack, by a patched version from the patch without updating XWiki. XWiki Platform Web Parent POM contiene recursos web para la plataforma XWiki, una plataforma wiki genérica. • https://github.com/xwiki/xwiki-platform/commit/047ce9fa4a7c13f3883438aaf54fc50f287a7e8e https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mxf2-4r22-5hq9 https://jira.xwiki.org/browse/XWIKI-19612 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 8.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-36093 – XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard
https://notcve.org/view.php?id=CVE-2022-36093
XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. By passing a template of the distribution wizard to the xpart template, user accounts can be created even when user registration is disabled. This also circumvents any email verification. Before versions 14.2 and 13.10.4, this can also be exploited on a private wiki, thus potentially giving the attacker access to the wiki. Depending on the configured default rights of users, this could also give attackers write access to an otherwise read-only public wiki. • https://github.com/xwiki/xwiki-platform/commit/70c64c23f4404f33289458df2a08f7c4be022755 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h5j3-5x63-p8jv https://jira.xwiki.org/browse/XWIKI-19558 • CWE-287: Improper Authentication CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-36092 – XWiki Platform Old Core vulnerable to Authentication Bypass Using the Login Action
https://notcve.org/view.php?id=CVE-2022-36092
XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 14.2 and 13.10.4, all rights checks that would normally prevent a user from viewing a document on a wiki can be bypassed using the login action and directly specified templates. This exposes title, content and comments of any document and properties of objects, though class and property name must be known. This is also exploitable on private wikis. This has been patched in versions 14.2 and 13.10.4 by properly checking view rights before loading documents and disallowing non-default templates in the login, registration and skin action. • https://github.com/xwiki/xwiki-platform/commit/71a6d0bb6f8ab718fcfaae0e9b8c16c2d69cd4bb https://github.com/xwiki/xwiki-platform/commit/9b7057d57a941592d763992d4299456300918208 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8h89-34w2-jpfm https://jira.xwiki.org/browse/XWIKI-18602 https://jira.xwiki.org/browse/XWIKI-19549 • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-36091 – XWiki Platform Web Templates vulnerable to Missing Authorization and Exposure of Private Personal Information to an Unauthorized Actor
https://notcve.org/view.php?id=CVE-2022-36091
XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. Through the suggestion feature, string and list properties of objects the user shouldn't have access to can be accessed in versions prior to 13.10.4 and 14.2. This includes private personal information like email addresses and salted password hashes of registered users but also other information stored in properties of objects. Sensitive configuration fields like passwords for LDAP or SMTP servers could be accessed. By exploiting an additional vulnerability, this issue can even be exploited on private wikis at least for string properties. • https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-599v-w48h-rjrm https://jira.xwiki.org/browse/XWIKI-18849 • CWE-359: Exposure of Private Personal Information to an Unauthorized Actor CWE-862: Missing Authorization •