xwiki · xwiki-platform
The Attachment UI component of XWiki Platform, a generic wiki platform, fails to neutralise JavaScript stored in attachment names within the move attachment form. An attacker with low-privilege access who can upload an attachment can name it with script that runs in the browser of any user who attempts to move that attachment, which requires user interaction.
XWiki Platform Attachment UI provides a macro to easily upload and select attachments for XWiki Platform, a generic wiki platform. Starting with version 14.0-rc-1 and prior to 14.4-rc-1, it's possible to store JavaScript in an attachment name, which will be executed by anyone trying to move the corresponding attachment. This issue has been patched in XWiki 14.4-rc-1. As a workaround, one may copy `moveStep1.vm` to `webapp/xwiki/templates/moveStep1.vm` and replace vulnerable code with code from the patch.
Disclosed on 8 Sep 2022. No public exploit code or confirmed exploitation is recorded.
4 fixes in xwiki-platform-attachment-ui over 7 months. The latest fix listed for xwiki-platform-attachment-ui is 14.10.2.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: org.xwiki.platform:xwiki-platform-attachment-ui.
Upgrade to 14.4.8 or later
Fixes this CVE and 1 other known vulnerability in this package (CVE-2023-29516).
Set the version to 14.4.8 or later in your pom.xml or build.gradle.
First fixed in 14.4-rc-1 for CVE-2022-36097.
| If you run | Upgrade to |
|---|---|
| 14.0-rc-1 up to 14.4-rc-1 | 14.4.8first fix for this CVE: 14.4-rc-1 |
“Up to” means the second version is the fix and is not affected.