CVE-2022-41931

Deeper analysis

xwiki-platform-icon-ui contains an eval injection vulnerability (CWE-95) that affects the icon picker macro in XWiki. Any user able to view commonly accessible documents can supply macro parameters that are not properly neutralized, resulting in execution of arbitrary Groovy, Python, or Velocity code on the server. The flaw is present in versions prior to the releases that contain the fix.

An attacker with view rights on the affected documents can therefore achieve remote code execution with the privileges of the XWiki application server, including full read, write, and delete access to wiki content and the ability to affect confidentiality, integrity, and availability across the instance. The CVSS 3.1 score of 9.9 reflects the combination of network attack vector, low complexity, and the scope change that allows the impact to extend beyond the vulnerable component.

The GitHub Security Advisory and XWiki Jira entry state that the issue is resolved in XWiki 13.10.7, 14.5, and 14.4.2. Administrators can either apply the referenced commit manually to the IconThemesCode.IconPickerMacro object or import the corrected document from the XAR archive of a patched release; both the advisory and the commit itself document these workarounds. The associated EPSS score has remained flat at 0.1893 with no material increase after disclosure.