CVE-2022-36099

Public Exploit
XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability

Description

XWiki Platform Wiki UI Main Wiki is software for managing subwikis on XWiki Platform, a generic wiki platform. Starting with version 5.3-milestone-2 and prior to versions 13.10.6 and 14.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the request (URL parameter) using the `XWikiServerClassSheet` if the user has view access to this sheet and another page that has been saved with programming rights, a standard condition on a public read-only XWiki installation or a private XWiki installation where the user has an account. This allows arbitrary Groovy/Python/Velocity code execution which allows bypassing all rights checks and thus both modification and disclosure of all content stored in the XWiki installation. Also, this could be used to impact the availability of the wiki. This has been patched in versions 13.10.6 and 14.4. As a workaround, edit the affected document `XWiki.XWikiServerClassSheet` or `WikiManager.XWikiServerClassSheet` and manually perform the changes from the patch fixing the issue. On XWiki versions 12.0 and later, it is also possible to import the document `XWiki.XWikiServerClassSheet` from the xwiki-platform-wiki-ui-mainwiki package version 14.4 using the import feature of the administration application as there have been no other changes to this document since XWiki 12.0.

Categories

9.9
CVSS
Severity: Critical
CVSS 3.1 •
EPSS 20.52% Top 5%
Vendor Advisory xwiki.org
Affected: xwiki xwiki-platform
Published at:
Updated at:

References

Link Tags
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xr6m-2p4m-jvqf third party advisory exploit
https://github.com/xwiki/xwiki-platform/commit/fc77f9f53bc65a4a9bfae3d5686615309c0c76cc third party advisory patch
https://jira.xwiki.org/browse/XWIKI-19746 vendor advisory

Frequently Asked Questions

What is the severity of CVE-2022-36099?
CVE-2022-36099 has been scored as a critical severity vulnerability.
How to fix CVE-2022-36099?
To fix CVE-2022-36099, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2022-36099 being actively exploited in the wild?
It is possible that CVE-2022-36099 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~21% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-36099?
CVE-2022-36099 affects xwiki xwiki-platform.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.