Security
Headlines
HeadlinesLatestCVEs

Headline

GHSA-fxwr-4vq9-9vhj: XWiki Cross-Site Request Forgery (CSRF) for actions on tags

Impact

It’s possible to perform a CSRF attack for adding or removing tags on XWiki pages.

Patches

The problem has been patched in XWiki 13.10.5 and 14.3.

Workarounds

It’s possible to fix the issue without upgrading by locally modifying the documentTags.vm template in your filesystem, to apply the changes exposed there: https://github.com/xwiki/xwiki-platform/commit/7ca56e40cf79a468cea54d3480b6b403f259f9ae.

References

https://jira.xwiki.org/browse/XWIKI-19550

For more information

If you have any questions or comments about this advisory:

ghsa
#csrf#web#git#java#jira#maven

Package

maven org.xwiki.platform:xwiki-platform-web-templates (Maven)

Affected versions

>= 2.0-milestone-1, < 13.10.5

>= 14.0, < 14.3

Patched versions

13.10.5

14.3

Description

Impact

It’s possible to perform a CSRF attack for adding or removing tags on XWiki pages.

Patches

The problem has been patched in XWiki 13.10.5 and 14.3.

Workarounds

It’s possible to fix the issue without upgrading by locally modifying the documentTags.vm template in your filesystem, to apply the changes exposed there: xwiki/xwiki-platform@7ca56e4.

References

https://jira.xwiki.org/browse/XWIKI-19550

For more information

If you have any questions or comments about this advisory:

  • Open an issue in Jira XWiki
  • Email us at security ML

References

  • GHSA-fxwr-4vq9-9vhj
  • https://nvd.nist.gov/vuln/detail/CVE-2022-36095
  • xwiki/xwiki-platform@7ca56e4
  • https://jira.xwiki.org/browse/XWIKI-19550

surli published the maintainer security advisory

Sep 8, 2022

Related news

CVE-2022-36095: [XWIKI-19550] Tags can be added and removed without CSRF token validation

XWiki Platform is a generic wiki platform. Prior to versions 13.10.5 and 14.3, it is possible to perform a Cross-Site Request Forgery (CSRF) attack for adding or removing tags on XWiki pages. The problem has been patched in XWiki 13.10.5 and 14.3. As a workaround, one may locally modify the `documentTags.vm` template in one's filesystem, to apply the changes exposed there.