Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2022-36099 is a critical-severity Code Injection (CWE-94) vulnerability in Xwiki Xwiki. Its CVSS base score is 9.9 (Critical).
Operationally, ranked in the top 0.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
XWiki Platform's Wiki UI Main Wiki component is affected by an injection vulnerability in the XWikiServerClassSheet (or WikiManager.XWikiServerClassSheet) that permits arbitrary wiki syntax, including Groovy, Python, and Velocity macros, to be supplied through a URL parameter. The flaw impacts versions from 5.3-milestone-2 through 13.10.5 and 14.3.x, allowing script execution when an attacker has view rights on the sheet and at least one page persisted with programming rights, conditions that are common on both public read-only and authenticated private installations.
An authenticated user meeting the view-access prerequisites can therefore execute code that bypasses all rights checks, resulting in full read/write access to every document, potential denial of service, and complete compromise of the XWiki instance. The attack requires no user interaction beyond crafting a malicious request and leverages the sheet's failure to sanitize or escape the supplied parameter before macro evaluation.
The official XWiki advisories and the patches released in 13.10.6 and 14.4 address the issue by correcting the input handling inside the affected sheet. Administrators can apply the fix by manually editing XWiki.XWikiServerClassSheet, importing the corrected document from the 14.4 xwiki-platform-wiki-ui-mainwiki package via the administration import feature, or upgrading to a patched release.
EPSS for the CVE has remained flat at 0.2170 with no material increase after disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-6981
Vulnerability Data
XWiki Platform Wiki UI Main Wiki is software for managing subwikis on XWiki Platform, a generic wiki platform. Starting with version 5.3-milestone-2 and prior to versions 13.10.6 and 14.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and…
more
Velocity script macros via the request (URL parameter) using the `XWikiServerClassSheet` if the user has view access to this sheet and another page that has been saved with programming rights, a standard condition on a public read-only XWiki installation or a private XWiki installation where the user has an account. This allows arbitrary Groovy/Python/Velocity code execution which allows bypassing all rights checks and thus both modification and disclosure of all content stored in the XWiki installation. Also, this could be used to impact the availability of the wiki. This has been patched in versions 13.10.6 and 14.4. As a workaround, edit the affected document `XWiki.XWikiServerClassSheet` or `WikiManager.XWikiServerClassSheet` and manually perform the changes from the patch fixing the issue. On XWiki versions 12.0 and later, it is also possible to import the document `XWiki.XWikiServerClassSheet` from the xwiki-platform-wiki-ui-mainwiki package version 14.4 using the import feature of the administration application as there have been no other changes to this document since XWiki 12.0.
- CWE(s)
Related Threats
Likely ATT&CK TechniquesAI
Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of URL parameters before they are interpreted as wiki syntax or executable macros, blocking the injection vector in XWikiServerClassSheet.
Enforces that only explicitly authorized subjects may cause script macros to execute with programming rights, preventing the rights-bypass that results from unsanitized parameter evaluation.
Controls information flows so that untrusted request data cannot reach Velocity/Groovy macro evaluation contexts without mediation, limiting the attack surface described in the CVE.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.PS-06's SDLC practices directly target injection flaws via secure coding and testing (mostly), yet as a single broad outcome it leaves many code-generation specifics unaddressed (partial).
PR.DS-10 protects runtime data confidentiality/integrity but has no bearing on neutralizing externally influenced input during code generation, so neither direction shows any preventive effect.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards explicitly require correct output encoding and escaping to preserve message structure.
Security testing in development can detect eval injection vulnerabilities before deployment.
Secure development life cycle mandates input validation and safe coding practices that directly prevent eval injection.
Application security requirements include rules against dynamic code execution of untrusted input.
Secure architecture principles discourage unsafe dynamic evaluation constructs.
Separation of environments limits the blast radius if eval injection occurs in non-production.