XWiki Cross-Site Request Forgery (CSRF) for actions on tags

TRUNG BÌNH 4.3CVE-2022-36095 · GHSA-fxwr-4vq9-9vhj · Công bố 08/09/2022 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2022-36095 là lỗ hổng mức TRUNG BÌNH (CVSS 4.3) ảnh hưởng org.xwiki.platform:xwiki-platform-web-templates, xwiki (xwiki).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.43%, cao hơn 36.9% các lỗ hổng khác.
Cách xử lý: cập nhật lên 14.3, 13.10.5, 13.10.6 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
org.xwiki.platform:xwiki-platform-web-templates Maven	`≥ 14.0, < 14.3≥ 2.0-milestone-1, < 13.10.5`	`14.313.10.5`
xwiki xwiki	`= 2.0≥ 14.0, < 14.3≥ 2.3, < 13.10.6`	`14.313.10.6`

Mô tả

Impact

It's possible to perform a CSRF attack for adding or removing tags on XWiki pages.

Patches

The problem has been patched in XWiki 13.10.5 and 14.3.

Workarounds

It's possible to fix the issue without upgrading by locally modifying the documentTags.vm template in your filesystem, to apply the changes exposed there: https://github.com/xwiki/xwiki-platform/commit/7ca56e40cf79a468cea54d3480b6b403f259f9ae.

References

https://jira.xwiki.org/browse/XWIKI-19550

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki
Email us at security ML

Mô tả của NVD

XWiki Platform is a generic wiki platform. Prior to versions 13.10.5 and 14.3, it is possible to perform a Cross-Site Request Forgery (CSRF) attack for adding or removing tags on XWiki pages. The problem has been patched in XWiki 13.10.5 and 14.3. As a workaround, one may locally modify the `documentTags.vm` template in one's filesystem, to apply the changes exposed there.