XWiki Cross-Site Request Forgery (CSRF) for actions on tags
GHSA-fxwr-4vq9-9vhj · CVE-2022-36095
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Impact
It's possible to perform a CSRF attack for adding or removing tags on XWiki pages.
Patches
The problem has been patched in XWiki 13.10.5 and 14.3.
Workarounds
It's possible to fix the issue without upgrading by locally modifying the documentTags.vm template in your filesystem, to apply the changes exposed there: https://github.com/xwiki/xwiki-platform/commit/7ca56e40cf79a468cea54d3480b6b403f259f9ae.
References
https://jira.xwiki.org/browse/XWIKI-19550
For more information
If you have any questions or comments about this advisory:
- Open an issue in Jira XWiki
- Email us at security ML
References
- WEB https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-fxwr-4vq9-9vhj
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2022-36095
- WEB https://github.com/xwiki/xwiki-platform/commit/7ca56e40cf79a468cea54d3480b6b403f259f9ae
- PACKAGE https://github.com/xwiki/xwiki-platform
- WEB https://jira.xwiki.org/browse/XWIKI-19550
Ready to move
Start Securing
Free, no credit card | First findings in minutes