CVE-2022-36095
XWiki Cross-Site Request Forgery (CSRF) for actions on tags
XWiki Platform is a generic wiki platform. Prior to versions 13.10.5 and 14.3, it is possible to perform a Cross-Site Request Forgery (CSRF) attack for adding or removing tags on XWiki pages. The problem has been patched in XWiki 13.10.5 and 14.3. As a workaround, one may locally modify the documentTags.vm template in one's filesystem, to apply the changes exposed there.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
XWiki Cross-Site Request Forgery (CSRF) for actions on tags
XWiki Platform is a generic wiki platform. Prior to versions 13.10.5 and 14.3, it is possible to perform a Cross-Site Request Forgery (CSRF) attack for adding or removing tags on XWiki pages. The problem has been patched in XWiki 13.10.5 and 14.3. As a workaround, one may locally modify the documentTags.vm template in one's filesystem, to apply the changes exposed there.
- Record
CVE-2022-36095- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
EUVDEUVD-2022-6813
XWiki Platform is a generic wiki platform. Prior to versions 13.10.5 and 14.3, it is possible to perform a Cross-Site Request Forgery (CSRF) attack for adding or removing tags on XWiki pages. The problem has been patched in XWiki 13.10.5 and 14.3. As a workaround, one may locally modify the documentTags.vm template in one's filesystem, to apply the changes exposed there.
- Record
EUVD-2022-6813- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fxwr-4vq9-9vhj
XWiki Cross-Site Request Forgery (CSRF) for actions on tags
Impact
It's possible to perform a CSRF attack for adding or removing tags on XWiki pages.
Patches
The problem has been patched in XWiki 13.10.5 and 14.3.
Workarounds
It's possible to fix the issue without upgrading by locally modifying the documentTags.vm template in your filesystem, to apply the changes exposed there: https://github.com/xwiki/xwiki-platform/commit/7ca56e40cf79a468cea54d3480b6b403f259f9ae.
References
https://jira.xwiki.org/browse/XWIKI-19550
For more information
If you have any questions or comments about this advisory:
- Open an issue in Jira XWiki
- Email us at security ML
- Record
GHSA-fxwr-4vq9-9vhj- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
NVD
XWiki Platform is a generic wiki platform. Prior to versions 13.10.5 and 14.3, it is possible to perform a Cross-Site Request Forgery (CSRF) attack for adding or removing tags on XWiki pages. The problem has been patched in XWiki 13.10.5 and 14.3. As a workaround, one may locally modify the documentTags.vm template in one's filesystem, to apply the changes exposed there.
- Record
CVE-2022-36095- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV
XWiki Cross-Site Request Forgery (CSRF) for actions on tags
XWiki Platform is a generic wiki platform. Prior to versions 13.10.5 and 14.3, it is possible to perform a Cross-Site Request Forgery (CSRF) attack for adding or removing tags on XWiki pages. The problem has been patched in XWiki 13.10.5 and 14.3. As a workaround, one may locally modify the documentTags.vm template in one's filesystem, to apply the changes exposed there.
- Record
CVE-2022-36095- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVGHSA-fxwr-4vq9-9vhj
XWiki Cross-Site Request Forgery (CSRF) for actions on tags
Impact
It's possible to perform a CSRF attack for adding or removing tags on XWiki pages.
Patches
The problem has been patched in XWiki 13.10.5 and 14.3.
Workarounds
It's possible to fix the issue without upgrading by locally modifying the documentTags.vm template in your filesystem, to apply the changes exposed there: https://github.com/xwiki/xwiki-platform/commit/7ca56e40cf79a468cea54d3480b6b403f259f9ae.
References
https://jira.xwiki.org/browse/XWIKI-19550
For more information
If you have any questions or comments about this advisory:
- Open an issue in Jira XWiki
- Email us at security ML
- Record
GHSA-fxwr-4vq9-9vhj- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.xwiki.platform:xwiki-platform-web-templatesMaven |
2.0-milestone-1 up to 13.10.5 | 13.10.5 |
org.xwiki.platform:xwiki-platform-web-templatesMaven |
14.0 up to 14.3 | 14.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-36095 is a medium vulnerability (CVSS 4.3) in Xwiki, published September 8, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in org.xwiki.platform:xwiki-platform-web-templates 13.10.5.
References
github.com/xwiki/xwiki-platform/security/advisories/GHSA-fxwr-4vq9-9vhj
jira.xwiki.org/browse/XWIKI-19550
nvd.nist.gov/vuln/detail/CVE-2022-36095