Cyber Resilience

CVE-2022-36100

RCE in Xwiki 1.7 – 13.10.6

Public PoCHigh EPSSRCE
Published
08 September 2022
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 9.9
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.74 99.4th percentile
Risk Priority 92 floored blend · peak EPSS

Summary

CVE-2022-36100 is a critical-severity Code Injection (CWE-94) vulnerability in Xwiki Xwiki. Its CVSS base score is 9.9 (Critical).

Operationally, ranked in the top 0.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-3 (Access Enforcement) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

XWiki Platform Applications Tag and XWiki Platform Tag UI contain an input sanitization flaw in the Main.Tags document. Versions starting at 1.7 for Applications Tag and prior to 13.10.6 and 14.4 for Tag UI fail to sanitize user-supplied content, permitting injection of unsanitized Groovy, Python, and Velocity scripts that execute with programming rights.

An attacker who can view the document—any user on a public wiki or any authenticated user on a private wiki—can therefore run arbitrary code, bypass all access controls, read or modify any stored content, and degrade wiki availability. On releases before 13.10.4 and 14.2 the same flaw can be chained with CVE-2022-36092 to remove the view-right prerequisite entirely.

The issue is fixed in XWiki 13.10.6 and 14.4. The referenced GitHub advisory and commit describe both the patch and a workaround that consists of manually editing Main.Tags or importing the corrected document from the 14.4 release via the administration UI on XWiki 10.9 and later. The associated EPSS score has remained flat at 0.0828 with no material increase after disclosure.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

XWiki Platform Applications Tag and XWiki Platform Tag UI are tag applications for XWiki, a generic wiki platform. Starting with version 1.7 in XWiki Platform Applications Tag and prior to 13.10.6 and 14.4 in XWiki Platform Tag UI, the tags…

more

document `Main.Tags` in XWiki didn't sanitize user inputs properly. This allowed users with view rights on the document (default in a public wiki or for authenticated users on private wikis) to execute arbitrary Groovy, Python and Velocity code with programming rights. This also allowed bypassing all rights checks and thus both modification and disclosure of all content stored in the XWiki installation. The vulnerability could be used to impact the availability of the wiki. On XWiki versions before 13.10.4 and 14.2, this can be combined with CVE-2022-36092, meaning that no rights are required to perform the attack. The vulnerability has been patched in versions 13.10.6 and 14.4. As a workaround, the patch that fixes the issue can be manually applied to the document `Main.Tags` or the updated version of that document can be imported from version 14.4 of xwiki-platform-tag-ui using the import feature in the administration UI on XWiki 10.9 and later.

CWE(s)

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1059 Command and Scripting Interpreter Executionconfidence: HIGH
The flaw permits direct injection and execution of unsanitized Groovy, Python, and Velocity scripts with full programming rights.
T1068 Exploitation for Privilege Escalation Privilege Escalationconfidence: HIGH
Arbitrary code execution with programming rights enables privilege escalation to bypass all access controls.
T1005 Data from Local System Collectionconfidence: HIGH
Successful exploitation grants the ability to read any stored content on the wiki.
T1485 Data Destruction Impactconfidence: MEDIUM
Arbitrary code execution with programming rights can be used to degrade or destroy wiki availability.
T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
The vulnerability is an input sanitization flaw in a publicly accessible wiki application that allows remote code execution.
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2022-36099Same product: Xwiki Xwiki
CVE-2023-46731Same product: Xwiki Xwiki
CVE-2023-30537Same product: Xwiki Xwiki
CVE-2024-31465Same product: Xwiki Xwiki
CVE-2024-21650Same product: Xwiki Xwiki
CVE-2023-40177Same product: Xwiki Xwiki
CVE-2025-24893Same product: Xwiki Xwiki
CVE-2023-26477Same product: Xwiki Xwiki
CVE-2024-31984Same product: Xwiki Xwiki
CVE-2024-31982Same product: Xwiki Xwiki

Affected Assets

xwiki
xwiki
1.7 — 13.10.6 · 14.0 — 14.4

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • AC-6 Least Privilege
  • AC-3 Access Enforcement
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V1.1.2
  • V1.2.1
  • V1.2.3
  • V1.3.1

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation and sanitization of all user-supplied content in Main.Tags to block Groovy/Python/Velocity script injection.

prevent

Enforces least privilege so that view-only users cannot obtain or exercise programming rights needed for arbitrary code execution.

prevent

Ensures the system enforces documented access-control policy and prevents the observed bypass of all rights checks on stored content.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

PR.PS-06's SDLC practices directly target injection flaws via secure coding and testing (mostly), yet as a single broad outcome it leaves many code-generation specifics unaddressed (partial).

PR.DS-10 none match
prevents

PR.DS-10 protects runtime data confidentiality/integrity but has no bearing on neutralizing externally influenced input during code generation, so neither direction shows any preventive effect.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Secure coding standards explicitly require correct output encoding and escaping to preserve message structure.

detects

Security testing in development can detect eval injection vulnerabilities before deployment.

prevents

Secure development life cycle mandates input validation and safe coding practices that directly prevent eval injection.

prevents

Application security requirements include rules against dynamic code execution of untrusted input.

prevents

Secure architecture principles discourage unsafe dynamic evaluation constructs.

none

Separation of environments limits the blast radius if eval injection occurs in non-production.

References