Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-29252

CVE-2022-29252: Cross-site Scripting in wiki manager join wiki page

7.4

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-29252
GHSA ID
GHSA-ph5x-h23x-7q5q
EPSS Score
0.73674%
CWE
CWE-79
Published
5/25/2022
Updated
1/27/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.xwiki.platform:xwiki-platform-wiki-ui-mainwikimaven< 12.10.1112.10.11
org.xwiki.platform:xwiki-platform-wiki-ui-mainwikimaven>= 13.0.0, < 13.4.713.4.7
org.xwiki.platform:xwiki-platform-wiki-ui-mainwikimaven>= 13.5.0, < 13.10.313.10.3

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper output encoding in the WikiManager.JoinWiki template. The original code directly injected the 'requestJoin' request parameter into an HTML input field without XML escaping, as shown in the diff. This allows attackers to inject arbitrary JavaScript via the 'requestJoin' parameter. The patched version explicitly adds $escapetool.xml to sanitize the output. While this is a template-level issue rather than a traditional function, the Velocity template rendering mechanism responsible for processing $!request.requestJoin is the vulnerable component.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t W* *oun* * possi*l* XSS v**tor in t** `WikiM*n***r.JoinWiki ` wiki p*** r*l*t** to t** "r*qu*stJoin" *i*l*. ### P*t***s T** issu* is p*t**** in v*rsions **.**.**, **.*-r*-*, **.*.*, **.**.*. ### Work*roun*s T** **si*st work*roun* is to *

Reasoning

T** vuln*r**ility st*ms *rom improp*r output *n*o*in* in t** WikiM*n***r.JoinWiki t*mpl*t*. T** ori*in*l *o** *ir**tly inj**t** t** 'r*qu*stJoin' r*qu*st p*r*m*t*r into *n *TML input *i*l* wit*out XML *s**pin*, *s s*own in t** *i**. T*is *llows *tt**