CVE-2022-29252

Cross-site Scripting in XWiki Platform Wiki UI Main Wiki

Severity Score

6.1

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

XWiki Platform Wiki UI Main Wiki is a package for managing subwikis. Starting with version 5.3-milestone-2, XWiki Platform Wiki UI Main Wiki contains a possible cross-site scripting vector in the `WikiManager.JoinWiki ` wiki page related to the "requestJoin" field. The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3. The easiest available workaround is to edit the wiki page `WikiManager.JoinWiki` (with wiki editor) according to the suggestion provided in the GitHub Security Advisory.

XWiki Platform Wiki UI Main Wiki es un paquete para administrar subwikis. A partir de la versión 5.3-milestone-2, XWiki Platform Wiki UI Main Wiki contiene un posible vector de tipo cross-site scripting en la página wiki "WikiManager.JoinWiki" relacionada con el campo "requestJoin". El problema está parcheado en versiones 12.10.11, 14.0-rc-1, 13.4.7 y 13.10.3. La mitigación más fácil disponible es editar la página wiki "WikiManager.JoinWiki" (con el editor wiki) de acuerdo con la sugerencia proporcionada en el aviso de seguridad de GitHub

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-04-13 CVE Reserved
2022-05-25 CVE Published
2023-12-16 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CWE-116: Improper Encoding or Escaping of Output

CAPEC

References (3)

URL	Tag	Source
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ph5x-h23x-7q5q	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://github.com/xwiki/xwiki-platform/commit/27f839133d41877e538d35fa88274b50a1c00b9b	2022-06-07

URL	Date	SRC
https://jira.xwiki.org/browse/XWIKI-19292	2022-06-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Xwiki Search vendor "Xwiki"		Xwiki Search vendor "Xwiki" for product "Xwiki"				>= 5.4 < 12.10.11 Search vendor "Xwiki" for product "Xwiki" and version " >= 5.4 < 12.10.11"		-		Affected
Xwiki Search vendor "Xwiki"		Xwiki Search vendor "Xwiki" for product "Xwiki"				>= 13.0 < 13.4.7 Search vendor "Xwiki" for product "Xwiki" and version " >= 13.0 < 13.4.7"		-		Affected
Xwiki Search vendor "Xwiki"		Xwiki Search vendor "Xwiki" for product "Xwiki"				>= 13.5 < 13.10.3 Search vendor "Xwiki" for product "Xwiki" and version " >= 13.5 < 13.10.3"		-		Affected
Xwiki Search vendor "Xwiki"		Xwiki Search vendor "Xwiki" for product "Xwiki"				5.3 Search vendor "Xwiki" for product "Xwiki" and version "5.3"		milestone2		Affected