XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a mention, macro anchor, or reference field. The stored code is executed by anyone visiting the page with the mention. This issue has been patched on XWiki 14.4 and 13.10.6. As a workaround, one may update `XWiki.Mentions.MentionsMacro` and edit the `Macro code` field of the `XWiki.WikiMacroClass` XObject.
Published 2022-09-08 21:15:08
Updated 2022-09-13 19:37:37
Source GitHub, Inc.
View at NVD,   CVE.org
Vulnerability category: Cross site scripting (XSS)

Exploit prediction scoring system (EPSS) score for CVE-2022-36098

0.38%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 73 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-36098

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
9.0
CRITICAL CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
2.3
6.0
NIST
8.9
HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
2.3
6.0
GitHub, Inc.

CWE ids for CVE-2022-36098

References for CVE-2022-36098

Products affected by CVE-2022-36098

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!