CVE-2022-419319.9CriticalCWE-95

CVE-2022-41931: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-ui

xwiki · xwiki-platform

Affected: xwiki-platform · Exploitation: possible (1 to 10%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

1.3%probability of exploitation in the next 30 days

Percentile not published

9.9CriticalCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'). Any user with view rights on commonly accessible documents including the icon picker macro can execute arbitrary Groovy, Python or Velocity code in XWiki due to improper neutralization of the macro parameters of the icon picker macro. The problem has been patched in XWiki 13.10.7, 14.5 and 14.4.2. Workarounds: The [patch](https://github.com/xwiki/xwiki-platform/commit/47eb8a5fba550f477944eb6da8ca91b87eaf1d01) can be manually applied by editing `IconThemesCode.IconPickerMacro` in the object editor. The whole document can also be replaced by the current version by importing the document from the XAR archive of a fixed version as the only changes to the document have been security fixes and small formatting changes.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

xwiki · xwiki-platform>= 6.4-milestone-2, < 13.10.7; >= 14.0.0, < 14.4.2

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Possible (1 to 10%). EPSS between 1% and 10%.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Improper Neutralization of Directives in Dynamically Evaluated Code · Command and Code Injection
Vendor: xwiki
Published: November 2022
Band: Possible (1 to 10%), November 2022

CoverageNo articles yet

No CyberSIXT article names CVE-2022-41931 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.