CVE-2022-36100

CVE-2022-36100 is a critical code injection vulnerability affecting XWiki Platform Applications Tag and XWiki Platform Tag UI versions prior to 13.10.6 and 14.4. The flaw stems from improper sanitization of user inputs in the Main.Tags document, allowing authenticated users with view rights to execute arbitrary Groovy, Python, and Velocity code with programming rights. This enables attackers to bypass rights checks, leading to full modification, disclosure, and potential unavailability of all content within the XWiki installation. Rated with a CVSS score of 8.8 (High), this vulnerability has a low attack complexity and requires only low privileges, making it easily exploitable. The potential impact is severe, encompassing high confidentiality, integrity, and availability compromise. For XWiki versions before 13.10.4 and 14.2, this can be combined with CVE-2022-36092, removing the need for any authentication. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, suggesting a lack of widespread attention. Organizations are advised to apply patches or workarounds immediately to mitigate this high-risk vulnerability.