Skip to content

XSS in wiki manager join wiki page

High
surli published GHSA-ph5x-h23x-7q5q May 25, 2022

Package

maven org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki (Maven)

Affected versions

>= 5.3-milestone-2

Patched versions

12.10.11, 14.0-rc-1, 13.4.7, 13.10.3

Description

Impact

We found a possible XSS vector in the WikiManager.JoinWiki wiki page related to the "requestJoin" field.

Patches

The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, 13.10.3.

Workarounds

The easiest workaround is to edit the wiki page WikiManager.JoinWiki (with wiki editor) and change the line

<input type='hidden' name='requestJoin' value="$!request.requestJoin"/>

into

<input type='hidden' name='requestJoin' value="$escapetool.xml($!request.requestJoin)">

References

For more information

If you have any questions or comments about this advisory:

Severity

High
7.4
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

CVE ID

CVE-2022-29252