CVE-2022-41928

Katalog CVE

CVSS 8.8 · High EPSS 1,0%

Kerentanan Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') pada xwiki. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml. The issue can also be reproduced by inserting the dangerous payload in the `height` or `alt` macro properties. This has been patched in versions 13.10.7, 14.4.2, and 14.5. The issue can be fixed on a running wiki by updating `XWiki.AttachmentSelector` with the versions below: - 14.5-rc-1+: https://github.com/xwiki/xwiki-platform/commit/eb15147adf94bddb92626f862c1710d45bcd64a7#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 - 14.4.2+: https://github.com/xwiki/xwiki-platform/commit/c02f8eb1f3c953d124f2c097021536f8bc00fa8d#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 - 13.10.7+: https://github.com/xwiki/xwiki-platform/commit/efd0df0468d46149ba68b66660b93f31b6318515#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23

Rincian

Terbit di NVD

23 November 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://jira.xwiki.org/browse/XWIKI-19800 exploit · issue tracking · advisory vendor
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9hqh-fmhg-vq2j exploit · patch · advisory pihak ketiga