CVE-2022-41928
CVSS V2 None
CVSS V3 None
Description
XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml. The issue can also be reproduced by inserting the dangerous payload in the `height` or `alt` macro properties. This has been patched in versions 13.10.7, 14.4.2, and 14.5. The issue can be fixed on a running wiki by updating `XWiki.AttachmentSelector` with the versions below: - 14.5-rc-1+: https://github.com/xwiki/xwiki-platform/commit/eb15147adf94bddb92626f862c1710d45bcd64a7#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 - 14.4.2+: https://github.com/xwiki/xwiki-platform/commit/c02f8eb1f3c953d124f2c097021536f8bc00fa8d#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 - 13.10.7+: https://github.com/xwiki/xwiki-platform/commit/efd0df0468d46149ba68b66660b93f31b6318515#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23
Overview
- CVE ID
- CVE-2022-41928
- Assigner
- security-advisories@github.com
- Vulnerability Status
- Analyzed
- Published Version
- 2022-11-23T19:15:12
- Last Modified Date
- 2022-11-30T16:38:19
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* | 1 | OR | 13.10.7 | |
| cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* | 1 | OR | 14.0.0 | 14.4.2 |
| cpe:2.3:a:xwiki:xwiki:5.0:milestone1:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:xwiki:xwiki:5.0:milestone2:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:xwiki:xwiki:14.4.3:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:xwiki:xwiki:14.4.4:*:*:*:*:*:*:* | 1 | OR |
References
| Reference URL | Reference Tags |
|---|---|
| https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9hqh-fmhg-vq2j | |
| https://jira.xwiki.org/browse/XWIKI-19800 |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2022-41928 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41928 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-11-23 20:00:17 | Added to TrackCVE | |||
| 2022-12-07 18:02:22 | 2022-11-23T19:15Z | 2022-11-23T19:15:12 | CVE Published Date | updated |
| 2022-12-07 18:02:22 | 2022-11-30T16:38:19 | CVE Modified Date | updated | |
| 2022-12-07 18:02:22 | Analyzed | Vulnerability Status | updated | |
| 2022-12-07 18:02:24 | CPE Information | updated |