Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:LSummary
CVE-2022-36094 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Xwiki Xwiki. Its CVSS base score is 8.9 (High).
Operationally, ranked in the top 0.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
XWiki Platform Web Parent POM, the component providing web resources for the generic XWiki wiki platform, contains a stored cross-site scripting vulnerability. Versions 1.0 through 13.10.5 and 14.2 allow an attacker to persist JavaScript inside an attachment filename; the script executes for any user who later views the attachment's revision history. The flaw is tracked as CWE-79 and CWE-80 and carries a CVSS 3.1 score of 8.9.
An authenticated user with attachment-upload rights can exploit the issue by uploading a file whose name contains executable script. When another user inspects the attachment history, the script runs in that user's browser context, enabling theft of session tokens, account takeover, or other actions within the wiki. No interaction beyond viewing the history page is required.
Official patches released in XWiki 13.10.6 and 14.3RC1 close the entry point. The project advisory and GitHub security advisory GHSA-mxf2-4r22-5hq9 also document a workaround that replaces the vulnerable viewattachrev.vm template with a corrected version without requiring a full platform upgrade.
EPSS for the CVE rose from a low baseline to a peak of 0.4921 before settling at the current value of 0.3885, indicating that exploitation interest increased after public disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-6885
Vulnerability Data
XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyone viewing the…
more
history of an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3RC1. As a workaround, it is possible to replace `viewattachrev.vm`, the entry point for this attack, by a patched version from the patch without updating XWiki.
- CWE(s)
Related Threats
Likely ATT&CK TechniquesAI
Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Enforces validation and sanitization of attachment filenames so that JavaScript payloads cannot be stored and later executed on the history view page.
Requires timely application of the vendor patches (13.10.6 / 14.3RC1) or the documented viewattachrev.vm workaround that close the stored-XSS entry point.
Restricts attachment-upload rights to the minimum set of users, directly limiting who can introduce a malicious filename that triggers the vulnerability.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly target introduction of XSS via coding standards/testing (mostly), yet the single broad outcome leaves many specific neutralization vectors unaddressed (partial).
Patching and EOL replacement can remediate known XSS instances in libraries or frameworks (partial) but do nothing to enforce input neutralization in application code (none).
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure-coding testing and automated code-analysis tools are applied to detect improper neutralization of script-related content during web-page generation.
Knowledge exchange on emerging attack techniques and patches reduces the likelihood that cross-site scripting flaws remain unaddressed in deployed applications.
Operational indicators of compromise for web-application attacks can be incorporated into WAF or input-filtering rules, lowering the likelihood that unsanitized data reaches the browser.
Requiring language-specific secure-coding standards and automated scanning during the SDLC catches missing output encoding or improper neutralization of untrusted data before the software reaches production.
Application security requirements explicitly call for neutralization of script-related HTML tags.
Secure-coding standards, SAST scans and removal of insecure code samples together eliminate the failure to neutralize script content that produces cross-site scripting flaws.