{"id":"CVE-2022-36097","summary":"XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form","details":"XWiki Platform Attachment UI provides a macro to easily upload and select attachments for XWiki Platform, a generic wiki platform. Starting with version 14.0-rc-1 and prior to 14.4-rc-1, it's possible to store JavaScript in an attachment name, which will be executed by anyone trying to move the corresponding attachment. This issue has been patched in XWiki 14.4-rc-1. As a workaround, one may copy `moveStep1.vm` to `webapp/xwiki/templates/moveStep1.vm` and replace vulnerable code with code from the patch.","aliases":["GHSA-9r9j-57rf-f6vj"],"modified":"2026-08-12T13:33:04.795151Z","published":"2022-09-08T20:35:11Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-79","CWE-80"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36097.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-19667"},{"type":"WEB","url":"https://raw.githubusercontent.com/xwiki/xwiki-platform/xwiki-platform-14.0-rc-1/xwiki-platform-core/xwiki-platform-attachment/xwiki-platform-attachment-api/src/main/resources/templates/attachment/moveStep1.vm"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36097.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9r9j-57rf-f6vj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36097"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/fbc4bfbae4f6ce8109addb281de86a03acdb9277"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"491547c4f74b9be58123ef22081ae7e6840a11c7"},{"fixed":"58bca6b6f0fb325008ef9147d3c0cdda3e1e306b"}],"database_specific":{"extracted_events":[{"introduced":"14.0"},{"fixed":"14.3"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"d971304b0e0bf4f6dad278de89518edc17459741"},{"fixed":"585702c6749495ff837c791127e584668be87d74"},{"fixed":"fbc4bfbae4f6ce8109addb281de86a03acdb9277"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"14.0"},{"fixed":"14.3"}],"source":["CPE_RANGE","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-36097.json","vanir_signatures_modified":"2026-08-12T13:33:04Z","vanir_signatures":[{"id":"CVE-2022-36097-3730de9a","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/fbc4bfbae4f6ce8109addb281de86a03acdb9277","target":{"file":"xwiki-platform-core/xwiki-platform-attachment/xwiki-platform-attachment-api/src/test/java/org/xwiki/attachment/MovePageTest.java"},"deprecated":false,"digest":{"line_hashes":["144112269652804985430326397908665468734","57485369595556582975586920152560715028","207927246977508328762372584778434905053","194573596879976515878614722227395761160","16499835398282794122322877264973357443","277387515681275039967405855077853682550","327156953449333079698111437528522796853","5752128128646401303826784200461671809","16763928384127996570742753923879648897","14633324937345571916216106436705093076","203286788004953815192606822542921980874","18843157567650475615792466350873776264","95203528425509402192216068284756057307","160115172735591751467638760755811950835","247133374109632728277349637892570889988","165495629888299589995390965710926053194","84608063636326994542030844398961951526","109471534300483652042738688595425032876","330842512226822451419400393701604569921"],"threshold":0.9}},{"target":{"file":"xwiki-platform-core/xwiki-platform-attachment/xwiki-platform-attachment-api/src/test/java/org/xwiki/attachment/MovePageTest.java","function":"submitMoveTargetAlreadyExists"},"deprecated":false,"digest":{"length":1572,"function_hash":"303656126860523265491399147678069883394"},"id":"CVE-2022-36097-7aed8cf3","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/fbc4bfbae4f6ce8109addb281de86a03acdb9277"},{"digest":{"function_hash":"261912327777436896290540527530319039452","length":1344},"id":"CVE-2022-36097-ec409297","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/fbc4bfbae4f6ce8109addb281de86a03acdb9277","target":{"file":"xwiki-platform-core/xwiki-platform-attachment/xwiki-platform-attachment-api/src/test/java/org/xwiki/attachment/MovePageTest.java","function":"submitMoveTargetEditNotAllowed"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L"}]}