Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1meHdyLTR2cTktOXZoas4AAu2B

XWiki Cross-Site Request Forgery (CSRF) for actions on tags

Impact

It's possible to perform a CSRF attack for adding or removing tags on XWiki pages.

Patches

The problem has been patched in XWiki 13.10.5 and 14.3.

Workarounds

It's possible to fix the issue without upgrading by locally modifying the documentTags.vm template in your filesystem, to apply the changes exposed there: https://github.com/xwiki/xwiki-platform/commit/7ca56e40cf79a468cea54d3480b6b403f259f9ae.

References

https://jira.xwiki.org/browse/XWIKI-19550

For more information

If you have any questions or comments about this advisory:

• Open an issue in Jira XWiki
• Email us at security ML

Permalink: https://github.com/advisories/GHSA-fxwr-4vq9-9vhj
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1meHdyLTR2cTktOXZoas4AAu2B
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 1 year ago
Updated: 10 months ago

CVSS Score: 4.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Identifiers: GHSA-fxwr-4vq9-9vhj, CVE-2022-36095
References:

• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-fxwr-4vq9-9vhj
• https://nvd.nist.gov/vuln/detail/CVE-2022-36095
• https://github.com/xwiki/xwiki-platform/commit/7ca56e40cf79a468cea54d3480b6b403f259f9ae
• https://jira.xwiki.org/browse/XWIKI-19550
• https://github.com/advisories/GHSA-fxwr-4vq9-9vhj

Affected Packages