CVE-2022-29258: Cross-site Scripting in Filter Stream Converter Application in XWiki Platform
Summary
CVE-2022-29258: Cross-site Scripting in Filter Stream Converter Application in XWiki Platform. Affects org.xwiki.platform:xwiki-platform-filter-ui across 3 version ranges.
>= 5.4.4, < 12.10.11
>= 13.0.0, < 13.4.7
>= 13.5.0, < 13.10.3
Fixed in 12.10.11, 13.4.7 or 13.10.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The XWiki Platform is an open-source wiki software that allows users to create and collaborate on content. The Filter Stream Converter Application is a component of the XWiki Platform that provides functionality for converting streams of data. It is used to filter and transform data in various formats. The application is written in Java and is available as a Maven package with the identifier 'org.xwiki.platform:xwiki-platform-filter-ui'. This vulnerability affects versions 5.4.4 to 12.10.11, 13.0.0 to 13.4.7, and 13.5.0 to 13.10.3 of the XWiki Platform Filter Stream Converter Application.
Vulnerability Detail
The vulnerability identified as CVE-2022-29258 is a cross-site scripting (XSS) vulnerability in the Filter Stream Converter Application of the XWiki Platform. This vulnerability allows an attacker to inject malicious scripts into the application, which can be executed in the context of other users visiting the affected pages. The vulnerability arises from improper handling of user input in the application's form fields. An attacker can exploit this vulnerability to steal sensitive information, perform actions on behalf of other users, or manipulate the application's content. The impact of this vulnerability is considered high, with a CVSS score of 7.4.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 5.4.4, < 12.10.1112.10.11 -
>= 13.0.0, < 13.4.713.4.7 -
>= 13.5.0, < 13.10.313.10.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the application is not immediately feasible, a temporary workaround can be implemented by modifying the 'Filter.FilterStreamDescriptorForm' wiki page. The following changes should be made to the lines of code in the wiki page:
<input type="text" id="$descriptorId" name="$descriptorId" value="#if($request.get($descriptorId))$escapetool.xml($request.get($descriptorId))#else$descriptor.defaultValue#end"/>
#else
<input type="text" id="$descriptorId" name="$descriptorId"#if($request.get($descriptorId))value="$escapetool.xml($request.get($descriptorId))"#end/>
These modifications ensure that user input is properly escaped and prevents the execution of injected scripts.
Conclusion
The XWiki Platform Filter Stream Converter Application is vulnerable to a cross-site scripting (XSS) attack, which can have severe consequences such as data theft and unauthorized actions. It is crucial to update the application to one of the patched versions or implement the provided workaround to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-filter-ui →
FAQ
This vulnerability allows an attacker to inject malicious scripts into the XWiki Platform Filter Stream Converter Application, potentially leading to the theft of sensitive information, unauthorized actions on behalf of other users, or manipulation of the application's content.
The recommended mitigation is to update the XWiki Platform Filter Stream Converter Application to one of the patched versions: 12.10.11, 14.0-rc-1, 13.4.7, or 13.10.3. These versions contain the necessary fixes to prevent the execution of injected scripts.
Yes, a temporary workaround can be implemented by modifying the 'Filter.FilterStreamDescriptorForm' wiki page as described in the 'workaround' section of this report.
Yes, the CVSS score for this vulnerability is 7.4, indicating a high level of severity.
You can find more information about this vulnerability in the GitHub Advisory Database entry: [link to GitHub Advisory Database entry]
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-filter-ui.
