An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1meHdyLTR2cTktOXZoas4AAu2B
XWiki Cross-Site Request Forgery (CSRF) for actions on tags
It's possible to perform a CSRF attack for adding or removing tags on XWiki pages.
The problem has been patched in XWiki 13.10.5 and 14.3.
It's possible to fix the issue without upgrading by locally modifying the documentTags.vm template in your filesystem, to apply the changes exposed there: https://github.com/xwiki/xwiki-platform/commit/7ca56e40cf79a468cea54d3480b6b403f259f9ae.
For more information
If you have any questions or comments about this advisory:https://github.com/advisories/GHSA-fxwr-4vq9-9vhj
Source: GitHub Advisory Database
Published: about 1 year ago
Updated: 10 months ago
CVSS Score: 4.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Identifiers: GHSA-fxwr-4vq9-9vhj, CVE-2022-36095
Fixed in: 14.3, 13.10.5