PT-2022-19506

CVE-2022-29258

Published

2022-05-31

Updated

2022-06-09

Description by

CVSS 3.1

7.4

High

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform Filter UI versions 5.4.4 through 12.10.10 XWiki Platform Filter UI versions 13.0.0 through 13.4.6 XWiki Platform Filter UI versions 13.10.0 through 13.10.2 XWiki Platform Filter UI versions 14.0.0-rc-0

Description The issue is related to a possible cross-site scripting vector in the Filter.FilterStreamDescriptorForm wiki page, affecting pretty much all the form fields printed in the home page of the application.

Recommendations For versions 5.4.4 through 12.10.10, edit the wiki page Filter.FilterStreamDescriptorForm according to the instructions in the GitHub Security Advisory. For versions 13.0.0 through 13.4.6, edit the wiki page Filter.FilterStreamDescriptorForm according to the instructions in the GitHub Security Advisory. For versions 13.10.0 through 13.10.2, edit the wiki page Filter.FilterStreamDescriptorForm according to the instructions in the GitHub Security Advisory. For versions 14.0.0-rc-0, edit the wiki page Filter.FilterStreamDescriptorForm according to the instructions in the GitHub Security Advisory.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-116: Improper Encoding or Escaping of Output

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers