Vulnerability record · CVE-2022-36099 · published 8 September 2022
CVE-2022-36099: XWiki Platform Wiki UI code injection via XWikiServerClassSheet
Xwiki · Xwiki
XWiki Platform Wiki UI Main Wiki allows injection of arbitrary wiki syntax, including Groovy, Python and Velocity script macros, through a URL parameter handled by the XWikiServerClassSheet. An authenticated user with view access to that sheet and any page saved with programming rights can execute arbitrary code, breaking all access controls on the wiki.
Description
XWiki Platform Wiki UI Main Wiki is software for managing subwikis on XWiki Platform, a generic wiki platform. Starting with version 5.3-milestone-2 and prior to versions 13.10.6 and 14.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the request (URL parameter) using the `XWikiServerClassSheet` if the user has view access to this sheet and another page that has been saved with programming rights, a standard condition on a public read-only XWiki installation or a private XWiki installation where the user has an account. This allows arbitrary Groovy/Python/Velocity code execution which allows bypassing all rights checks and thus both modification and disclosure of all content stored in the XWiki installation. Also, this could be used to impact the availability of the wiki. This has been patched in versions 13.10.6 and 14.4. As a workaround, edit the affected document `XWiki.XWikiServerClassSheet` or `WikiManager.XWikiServerClassSheet` and manually perform the changes from the patch fixing the issue. On XWiki versions 12.0 and later, it is also possible to import the document `XWiki.XWikiServerClassSheet` from the xwiki-platform-wiki-ui-mainwiki package version 14.4 using the import feature of the administration application as there have been no other changes to this document since XWiki 12.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 8.8 with low privileges and no user interaction, very high EPSS, and public exploit material, though no KEV listing or ransomware use.
What it is
XWiki Platform Wiki UI Main Wiki allows injection of arbitrary wiki syntax, including Groovy, Python and Velocity script macros, through a URL parameter handled by the XWikiServerClassSheet. An authenticated user with view access to that sheet and any page saved with programming rights can execute arbitrary code, breaking all access controls on the wiki.
Impact
An attacker gains arbitrary code execution with the rights of the wiki server, allowing modification and disclosure of all content stored in the XWiki installation and potentially impacting availability.
Attack surface
Reached remotely over the network via a crafted request (URL parameter) to the affected sheet; the vector requires low privileges (an account with view access) and no user interaction.
Exploitation
No CISA KEV listing and no ransomware association; EPSS is very high (0.7589, 99.5th percentile) and a reference is tagged Exploit, indicating public exploit material exists.
What to do
- Upgrade to XWiki 13.10.6 or 14.4, which contain the patch
- If immediate upgrade is not possible, manually apply the patch changes to XWiki.XWikiServerClassSheet or WikiManager.XWikiServerClassSheet
- On XWiki 12.0 and later, import XWiki.XWikiServerClassSheet from xwiki-platform-wiki-ui-mainwiki 14.4 via the administration import feature
- Restrict accounts and view rights on the affected sheet and on pages saved with programming rights
- Review pages with programming rights and remove unnecessary ones
Detection
- Monitor web requests for URL parameters targeting XWikiServerClassSheet for Groovy, Python or Velocity macro syntax
- Alert on creation or modification of pages saved with programming rights
- Review XWiki logs for script macro execution errors or unexpected Groovy/Python/Velocity activity
- Audit accounts with view access to the affected sheet for anomalous access patterns
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://github.com/xwiki/xwiki-platform/commit/fc77f9f53bc65a4a9bfae3d5686615309c0c76cc | PatchThird Party Advisory |
| https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xr6m-2p4m-jvqf | ExploitThird Party Advisory |
| https://jira.xwiki.org/browse/XWIKI-19746 | Vendor Advisory |
| https://github.com/xwiki/xwiki-platform/commit/fc77f9f53bc65a4a9bfae3d5686615309c0c76cc | PatchThird Party Advisory |
| https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xr6m-2p4m-jvqf | ExploitThird Party Advisory |
| https://jira.xwiki.org/browse/XWIKI-19746 | Vendor Advisory |
Track CVE-2022-36099 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-36099), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
