CVE-2022-29258

XWiki Platform Filter UI provides a generic user interface to convert from a XWiki Filter input stream to an output stream with settings for each stream. Starting with versions 6.0-milestone-2 and 5.4.4 and prior to versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3, XWiki Platform Filter UI contains a possible cross-site scripting vector in the `Filter.FilterStreamDescriptorForm` wiki page related to pretty much all the form fields printed in the home page of the application. The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3. The easiest workaround is to edit the wiki page `Filter.FilterStreamDescriptorForm` (with wiki editor) according to the instructions in the GitHub Security Advisory.

• CWE-80
• CWE-116
• CWE-79

• https://github.com/xwiki/xwiki-platform/commit/21906acb5ee2304552f56f9bbdbf8e7d368f7f3aPatch, Third Party Advisory
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xjfw-5vv5-vjq2Third Party Advisory
• https://jira.xwiki.org/browse/XWIKI-19293Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/21906acb5ee2304552f56f9bbdbf8e7d368f7f3aPatch, Third Party Advisory
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xjfw-5vv5-vjq2Third Party Advisory
• https://jira.xwiki.org/browse/XWIKI-19293Vendor Advisory

Published

May 31, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29252XWiki Platform Wiki UI Main Wiki is a package for managing s…6.1
• CVE-2022-29253XWiki Platform is a generic wiki platform offering runtime s…2.7
• CVE-2022-29254silverstripe-omnipay is a SilverStripe integration with Omni…6.5
• CVE-2022-29255Vyper is a Pythonic Smart Contract Language for the ethereum…7.5
• CVE-2022-29256sharp is an application for Node.js image processing. Prior …6.7
• CVE-2022-29257Electron is a framework for writing cross-platform desktop a…7.2
• CVE-2022-2926The Download Manager WordPress plugin before 3.2.55 does not…4.9
• CVE-2022-29262Improper buffer restrictions in some Intel(R) Server Board B…6.7
• CVE-2022-29263On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x v…7.8
• CVE-2022-29264An issue was discovered in coreboot 4.13 through 4.16. On AP…9.8
• CVE-2022-29265Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not re…7.5
• CVE-2022-29266In APache APISIX before 3.13.1, the jwt-auth plugin has a se…7.5