CVE-2022-36094
XWiki Platform Web Parent POM vulnerable to XSS in the attachment history
XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyone viewing the history of an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3RC1. As a workaround, it is possible to replace viewattachrev.vm, the entry point for this attack, by a patched version from the patch without updating XWiki.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
XWiki Platform Web Parent POM vulnerable to XSS in the attachment history
XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyone viewing the history of an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3RC1. As a workaround, it is possible to replace viewattachrev.vm, the entry point for this attack, by a patched version from the patch without updating XWiki.
- Record
CVE-2022-36094- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
EUVDEUVD-2022-6885
XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyone viewing the history of an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3RC1. As a workaround, it is possible to replace viewattachrev.vm, the entry point for this attack, by a patched version from the patch without updating XWiki.
- Record
EUVD-2022-6885- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mxf2-4r22-5hq9
XWiki Platform Web Parent POM vulnerable to XSS in the attachment history
Impact
It's possible to store a JavaScript which will be executed by anyone viewing the history of an attachment containing javascript in its name.
For example, attachment a file with name ><img src=1 onerror=alert(1)>.jpg will execute the alert.
Patches
This issue has been patched in XWiki 13.10.6 and 14.3RC1.
Workarounds
It is possible to replace viewattachrev.vm, the entry point for this attack, by a patched version from the patch without updating XWiki.
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in Jira XWiki.org
- Email us at Security Mailing List
- Record
GHSA-mxf2-4r22-5hq9- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
NVD
XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyone viewing the history of an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3RC1. As a workaround, it is possible to replace viewattachrev.vm, the entry point for this attack, by a patched version from the patch without updating XWiki.
- Record
CVE-2022-36094- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L - CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
OSV
XWiki Platform Web Parent POM vulnerable to XSS in the attachment history
XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyone viewing the history of an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3RC1. As a workaround, it is possible to replace viewattachrev.vm, the entry point for this attack, by a patched version from the patch without updating XWiki.
- Record
CVE-2022-36094- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
OSVGHSA-mxf2-4r22-5hq9
XWiki Platform Web Parent POM vulnerable to XSS in the attachment history
Impact
It's possible to store a JavaScript which will be executed by anyone viewing the history of an attachment containing javascript in its name.
For example, attachment a file with name ><img src=1 onerror=alert(1)>.jpg will execute the alert.
Patches
This issue has been patched in XWiki 13.10.6 and 14.3RC1.
Workarounds
It is possible to replace viewattachrev.vm, the entry point for this attack, by a patched version from the patch without updating XWiki.
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in Jira XWiki.org
- Email us at Security Mailing List
- Record
GHSA-mxf2-4r22-5hq9- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.xwiki.platform:xwiki-platform-webMaven |
1.0 up to 13.10.6 | 13.10.6 |
org.xwiki.platform:xwiki-platform-webMaven |
14.0 up to 14.3-rc-1 | 14.3-rc-1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-36094 is a high vulnerability (CVSS 8.9) in Xwiki, published September 8, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 64.8%, the 99th percentile. Fixed in org.xwiki.platform:xwiki-platform-web 13.10.6.
References
github.com/xwiki/xwiki-platform/security/advisories/GHSA-mxf2-4r22-5hq9
jira.xwiki.org/browse/XWIKI-19612
nvd.nist.gov/vuln/detail/CVE-2022-36094