Cyber Resilience

CVE-2022-36099

RCE in Xwiki 5.4 – 13.10.6

Public PoCHigh EPSSRCE
Published
08 September 2022
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 9.9
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.76 99.5th percentile
Risk Priority 92 floored blend · peak EPSS

Summary

CVE-2022-36099 is a critical-severity Code Injection (CWE-94) vulnerability in Xwiki Xwiki. Its CVSS base score is 9.9 (Critical).

Operationally, ranked in the top 0.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

XWiki Platform's Wiki UI Main Wiki component is affected by an injection vulnerability in the XWikiServerClassSheet (or WikiManager.XWikiServerClassSheet) that permits arbitrary wiki syntax, including Groovy, Python, and Velocity macros, to be supplied through a URL parameter. The flaw impacts versions from 5.3-milestone-2 through 13.10.5 and 14.3.x, allowing script execution when an attacker has view rights on the sheet and at least one page persisted with programming rights, conditions that are common on both public read-only and authenticated private installations.

An authenticated user meeting the view-access prerequisites can therefore execute code that bypasses all rights checks, resulting in full read/write access to every document, potential denial of service, and complete compromise of the XWiki instance. The attack requires no user interaction beyond crafting a malicious request and leverages the sheet's failure to sanitize or escape the supplied parameter before macro evaluation.

The official XWiki advisories and the patches released in 13.10.6 and 14.4 address the issue by correcting the input handling inside the affected sheet. Administrators can apply the fix by manually editing XWiki.XWikiServerClassSheet, importing the corrected document from the 14.4 xwiki-platform-wiki-ui-mainwiki package via the administration import feature, or upgrading to a patched release.

EPSS for the CVE has remained flat at 0.2170 with no material increase after disclosure.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

XWiki Platform Wiki UI Main Wiki is software for managing subwikis on XWiki Platform, a generic wiki platform. Starting with version 5.3-milestone-2 and prior to versions 13.10.6 and 14.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and…

more

Velocity script macros via the request (URL parameter) using the `XWikiServerClassSheet` if the user has view access to this sheet and another page that has been saved with programming rights, a standard condition on a public read-only XWiki installation or a private XWiki installation where the user has an account. This allows arbitrary Groovy/Python/Velocity code execution which allows bypassing all rights checks and thus both modification and disclosure of all content stored in the XWiki installation. Also, this could be used to impact the availability of the wiki. This has been patched in versions 13.10.6 and 14.4. As a workaround, edit the affected document `XWiki.XWikiServerClassSheet` or `WikiManager.XWikiServerClassSheet` and manually perform the changes from the patch fixing the issue. On XWiki versions 12.0 and later, it is also possible to import the document `XWiki.XWikiServerClassSheet` from the xwiki-platform-wiki-ui-mainwiki package version 14.4 using the import feature of the administration application as there have been no other changes to this document since XWiki 12.0.

CWE(s)

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1059 Command and Scripting Interpreter Executionconfidence: HIGH
The vulnerability allows arbitrary Groovy, Python, and Velocity macros to be supplied via a URL parameter and executed server-side.
T1068 Exploitation for Privilege Escalation Privilege Escalationconfidence: HIGH
Successful exploitation bypasses all rights checks, granting full read/write access and enabling privilege escalation to programming rights.
T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
The flaw is an injection vulnerability in a publicly accessible wiki sheet that permits remote code execution through crafted requests.
T1059.006 Python Executionconfidence: HIGH
Python macros can be injected and executed via the vulnerable parameter.
T1059.001 PowerShell Executionconfidence: MEDIUM
Groovy macros can be injected and executed, which aligns with PowerShell-like scripting interpreters in the ATT&CK taxonomy.
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2022-36100Same product: Xwiki Xwiki
CVE-2023-46731Same product: Xwiki Xwiki
CVE-2023-30537Same product: Xwiki Xwiki
CVE-2024-31465Same product: Xwiki Xwiki
CVE-2024-21650Same product: Xwiki Xwiki
CVE-2023-40177Same product: Xwiki Xwiki
CVE-2025-24893Same product: Xwiki Xwiki
CVE-2023-26477Same product: Xwiki Xwiki
CVE-2024-31984Same product: Xwiki Xwiki
CVE-2024-31982Same product: Xwiki Xwiki

Affected Assets

xwiki
xwiki
5.3 · 5.4 — 13.10.6 · 14.0 — 14.4

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • AC-3 Access Enforcement
  • AC-4 Information Flow Enforcement
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V1.1.2
  • V1.2.1
  • V1.2.3
  • V1.3.1

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation and sanitization of URL parameters before they are interpreted as wiki syntax or executable macros, blocking the injection vector in XWikiServerClassSheet.

prevent

Enforces that only explicitly authorized subjects may cause script macros to execute with programming rights, preventing the rights-bypass that results from unsanitized parameter evaluation.

prevent

Controls information flows so that untrusted request data cannot reach Velocity/Groovy macro evaluation contexts without mediation, limiting the attack surface described in the CVE.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

PR.PS-06's SDLC practices directly target injection flaws via secure coding and testing (mostly), yet as a single broad outcome it leaves many code-generation specifics unaddressed (partial).

PR.DS-10 none match
prevents

PR.DS-10 protects runtime data confidentiality/integrity but has no bearing on neutralizing externally influenced input during code generation, so neither direction shows any preventive effect.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Secure coding standards explicitly require correct output encoding and escaping to preserve message structure.

detects

Security testing in development can detect eval injection vulnerabilities before deployment.

prevents

Secure development life cycle mandates input validation and safe coding practices that directly prevent eval injection.

prevents

Application security requirements include rules against dynamic code execution of untrusted input.

prevents

Secure architecture principles discourage unsafe dynamic evaluation constructs.

none

Separation of environments limits the blast radius if eval injection occurs in non-production.

References