Cyber Resilience

CVE-2022-36096

XSS in Xwiki 2.3 – 13.10.6

High EPSSXSS
Published
08 September 2022
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 8.9
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
EPSS Score 0.59 99.0th percentile
Risk Priority 80 floored blend · peak EPSS

Summary

CVE-2022-36096 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Xwiki Xwiki. Its CVSS base score is 8.9 (High).

Operationally, ranked in the top 1.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-15 (Information Output Filtering) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

The vulnerability is a stored cross-site scripting flaw (CWE-79/CWE-80) in the XWiki Platform Index UI, specifically the deleted attachments index page. It affects XWiki Platform versions prior to 13.10.6 and 14.3, where JavaScript embedded in an attachment filename is stored and later executed in the browser of any user who views the index.

An attacker with low privileges can upload or create an attachment whose name contains malicious JavaScript. When another user subsequently views the deleted attachments index, the script executes with the viewing user's permissions, enabling theft of sensitive data, account takeover, or other actions that produce high confidentiality and integrity impact along with limited availability impact.

The issue was fixed in XWiki 13.10.6 and 14.3. The project advisory and associated commits describe a workaround that consists of editing the XWiki.DeletedAttachments wiki page via the object editor, locating the JavaScriptExtension object, and applying the sanitization changes present in the patch commit.

EPSS reached a peak of 0.5451 before receding to the current value of 0.4425, indicating measurable post-disclosure exploitation interest.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wiki platform. Prior to versions 13.10.6 and 14.3, it's possible to store JavaScript which will be executed…

more

by anyone viewing the deleted attachments index with an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3. As a workaround, modify fix the vulnerability by editing the wiki page `XWiki.DeletedAttachments` with the object editor, open the `JavaScriptExtension` object and apply on the content the changes that can be found on the fix commit.

CWE(s)

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1189 Drive-by Compromise Initial Accessconfidence: HIGH
Stored XSS in attachment filename executes when users view the deleted attachments index, enabling drive-by compromise.
T1056.003 Web Portal Capture Collectionconfidence: MEDIUM
XSS payload can capture web portal input such as session cookies or credentials from the affected XWiki pages.
T1539 Steal Web Session Cookie Credential Accessconfidence: MEDIUM
Successful XSS can steal web session cookies from authenticated users viewing the index.
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2022-36094Same product: Xwiki Xwiki
CVE-2022-36097Same product: Xwiki Xwiki
CVE-2023-35157Same product: Xwiki Xwiki
CVE-2023-29508Same product: Xwiki Xwiki
CVE-2023-35153Same product: Xwiki Xwiki
CVE-2022-36098Same product: Xwiki Xwiki
CVE-2023-45136Same product: Xwiki Xwiki
CVE-2023-29201Same product: Xwiki Xwiki
CVE-2023-45137Same product: Xwiki Xwiki
CVE-2023-26480Same product: Xwiki Xwiki

Affected Assets

xwiki
xwiki
2.2 · 2.3 — 13.10.6 · 14.0 — 14.3

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • SI-15 Information Output Filtering
  • SC-18 Mobile Code
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V1.1.2
  • V1.3.2
  • V1.2.1
  • V1.3.1

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly enforces validation and sanitization of untrusted inputs such as attachment filenames before they are stored and later rendered in the DeletedAttachments index.

prevent

Requires filtering of information outputs to neutralize embedded scripts, preventing execution of malicious JavaScript present in attachment names when the index page is viewed.

SC-18 Mobile Code partial match
prevent

Establishes restrictions and handling rules for mobile code (JavaScript) to block execution of untrusted scripts injected via stored attachment metadata.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly target introduction of XSS via coding standards/testing (mostly), yet the single broad outcome leaves many specific neutralization vectors unaddressed (partial).

PR.PS-02 partial match
prevents

Patching and EOL replacement can remediate known XSS instances in libraries or frameworks (partial) but do nothing to enforce input neutralization in application code (none).

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Secure-coding testing and automated code-analysis tools are applied to detect improper neutralization of script-related content during web-page generation.

prevents

Knowledge exchange on emerging attack techniques and patches reduces the likelihood that cross-site scripting flaws remain unaddressed in deployed applications.

prevents

Operational indicators of compromise for web-application attacks can be incorporated into WAF or input-filtering rules, lowering the likelihood that unsanitized data reaches the browser.

prevents

Requiring language-specific secure-coding standards and automated scanning during the SDLC catches missing output encoding or improper neutralization of untrusted data before the software reaches production.

prevents

Application security requirements explicitly call for neutralization of script-related HTML tags.

prevents

Secure-coding standards, SAST scans and removal of insecure code samples together eliminate the failure to neutralize script content that produces cross-site scripting flaws.

References