CVE-2022-29258

Description

XWiki Platform Filter UI provides a generic user interface to convert from a XWiki Filter input stream to an output stream with settings for each stream. Starting with versions 6.0-milestone-2 and 5.4.4 and prior to versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3, XWiki Platform Filter UI contains a possible cross-site scripting vector in the Filter.FilterStreamDescriptorForm wiki page related to pretty much all the form fields printed in the home page of the application. The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3. The easiest workaround is to edit the wiki page Filter.FilterStreamDescriptorForm (with wiki editor) according to the instructions in the GitHub Security Advisory.

Risk Information

Base Score

6.1

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Score

Exploitation Probability

0.827

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2022-29258 are fixed in XWiki - xwiki-platform-filter-ui 12.10.11	Windows
Vulnerabilities CVE-2022-29258 are fixed in XWiki - xwiki-platform-filter-ui 13.4.7	Windows
Vulnerabilities CVE-2022-29258 are fixed in XWiki - xwiki-platform-filter-ui 13.10.3	Windows
Vulnerabilities CVE-2022-29258 are fixed in XWiki - xwiki-platform-filter-ui for Linux 12.10.11	Linux
Vulnerabilities CVE-2022-29258 are fixed in XWiki - xwiki-platform-filter-ui for Linux 13.4.7	Linux
Vulnerabilities CVE-2022-29258 are fixed in XWiki - xwiki-platform-filter-ui for Linux 13.10.3	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234