cve.bz

CVE-2022-36095

4.3 mediumEPSS 0.4%

XWiki Platform is a generic wiki platform. Prior to versions 13.10.5 and 14.3, it is possible to perform a Cross-Site Request Forgery (CSRF) attack for adding or removing tags on XWiki pages. The problem has been patched in XWiki 13.10.5 and 14.3. As a workaround, one may locally modify the `documentTags.vm` template in one's filesystem, to apply the changes exposed there.

Severity

CVSS 3.1

4.3 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS
0.4% chance of exploitation in the next 30 days; higher than 36% of CVEs (scores of 2026-10-31)
CWE
CWE-352
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-fxwr-4vq9-9vhjMavenorg.xwiki.platform:xwiki-platform-web-templates>=2.0-milestone-1 <13.10.513.10.5
GHSA-fxwr-4vq9-9vhjMavenorg.xwiki.platform:xwiki-platform-web-templates>=14.0 <14.314.3

References

Check your stackJSON