High
XWiki Platform vulnerable to Cross-Site Request Forgery (CSRF) allowing to delete or rename tags
Type: advisorySources: OSV
XWiki Platform is vulnerable to Cross-Site Request Forgery (CSRF) that may allow attackers to delete or rename tags without needing any confirmation. The problem has been patched in XWiki 13.10.7, 14.4.1 and 14.5RC1. Workarounds: It's possible to patch existing instances directly by editing the page Main.Tags and add this kind of check, in the code for renaming and for deleting: ``` #if (!$services.csrf.isTokenValid($request.get('form_token'))) #set ($discard = $response.sendError(401, "Wrong CSRF token")) #end ```
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2022-41927
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 20:12 UTC · Revision 1
Source evidence
XWiki Platform vulnerable to Cross-Site Request Forgery (CSRF) allowing to delete or rename tags
core-osv · Original sourcePublished 23 Nov 2022, 00:00 UTC
XWiki Platform is vulnerable to Cross-Site Request Forgery (CSRF) that may allow attackers to delete or rename tags without needing any confirmation. The problem has been patched in XWiki 13.10.7, 14.4.1 and 14.5RC1. Workarounds: It's possible to patch existing instances directly by editing the page Main.Tags and add this kind of check, in the code for renaming and for deleting: ``` #if (!$services.csrf.isTokenValid($request.get('form_token'))) #set ($discard = $response.sendError(401, "Wrong CSRF token")) #end ```
osv:CVE-2022-41927
Complete source record
{
"id": "26841b3dc3cea44995821fd0b7b776366ddd0ce02fb98c41802c6f371fa2e342",
"url": "https://osv.dev/vulnerability/CVE-2022-41927",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "XWiki Platform vulnerable to Cross-Site Request Forgery (CSRF) allowing to delete or rename tags",
"summary": "XWiki Platform is vulnerable to Cross-Site Request Forgery (CSRF) that may allow attackers to delete or rename tags without needing any confirmation. The problem has been patched in XWiki 13.10.7, 14.4.1 and 14.5RC1. Workarounds: It's possible to patch existing instances directly by editing the page Main.Tags and add this kind of check, in the code for renaming and for deleting: ``` #if (!$services.csrf.isTokenValid($request.get('form_token'))) #set ($discard = $response.sendError(401, \"Wrong CSRF token\")) #end ```",
"evidence": "osv:CVE-2022-41927",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2022-41927",
"aliases": [
"CVE-2022-41927",
"GHSA-mq7h-5574-hw9f"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/xwiki/xwiki-commons",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "ea813db28a986642d4862cef18015f0e7e8b7e29"
},
{
"introduced": "5777d5503cc2de8fb9e65fc2f5c6dcf6eb8bf10c"
},
{
"last_affected": "17d3df2f9d5cf80b652df565e0c7533e0404fc0d"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "13.10.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:xwiki:xwiki:3.2:milestone2:*:*:*:*:*:*",
"range": [
{
"introduced": "3.2-milestone2"
},
{
"last_affected": "3.2-milestone2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:xwiki:xwiki:3.2:milestone3:*:*:*:*:*:*",
"range": [
{
"introduced": "3.2-milestone3"
},
{
"last_affected": "3.2-milestone3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:xwiki:xwiki:14.4:*:*:*:*:*:*:*",
"range": [
{
"introduced": "14.4"
},
{
"last_affected": "14.4"
}
],
"source": "CPE_STRING"
}
]
}
},
{
"repo": "https://github.com/xwiki/xwiki-platform",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "950f435a66fb9fe437d27df8a6aaf20e01322e1f"
},
{
"introduced": "cd3dddef129c492986cb6da4f277721ab602846c"
},
{
"fixed": "7fd4cda0590180c4d34f557597e9e10e263def9e"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "13.10.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:xwiki:xwiki:3.2:milestone2:*:*:*:*:*:*",
"range": [
{
"introduced": "3.2-milestone2"
},
{
"last_affected": "3.2-milestone2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:xwiki:xwiki:3.2:milestone3:*:*:*:*:*:*",
"range": [
{
"introduced": "3.2-milestone3"
},
{
"last_affected": "3.2-milestone3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:xwiki:xwiki:14.4:*:*:*:*:*:*:*",
"range": [
{
"introduced": "14.4"
},
{
"last_affected": "14.4"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "7fd4cda0590180c4d34f557597e9e10e263def9e"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"14.4",
"3.2-milestone2",
"3.2-milestone3",
"xwiki-commons-13.10.6",
"xwiki-commons-14.4",
"xwiki-commons-14.4-rc-1",
"xwiki-commons-13.10.5",
"xwiki-commons-13.10.4",
"xwiki-commons-13.10.3",
"xwiki-commons-13.10.2",
"xwiki-commons-13.10.1",
"xwiki-commons-13.10",
"xwiki-commons-13.10-rc-1",
"xwiki-commons-8.3-milestone-2",
"xwiki-commons-8.3-milestone-1",
"xwiki-commons-8.2-milestone-2",
"xwiki-commons-8.2-milestone-1",
"xwiki-commons-8.1-milestone-2",
"xwiki-commons-8.1-milestone-1",
"xwiki-commons-8.0-milestone-2",
"xwiki-commons-8.0-milestone-1",
"xwiki-platform-13.10.6",
"xwiki-platform-13.10.5",
"xwiki-platform-13.10.4",
"xwiki-platform-13.10.3",
"xwiki-platform-13.10.2",
"xwiki-platform-13.10.1",
"xwiki-platform-13.10",
"xwiki-platform-13.10-rc-1",
"xwiki-platform-9.9-rc-2",
"xwiki-platform-8.3-milestone-1",
"xwiki-platform-8.2-milestone-2",
"xwiki-platform-8.2-milestone-1",
"xwiki-platform-8.1-milestone-2",
"xwiki-platform-8.1-milestone-1",
"xwiki-platform-8.0-milestone-2",
"xwiki-platform-8.0-milestone-1",
"xwiki-platform-7.4-milestone-2",
"xwiki-platform-7.4-milestone-1",
"xwiki-platform-7.3-milestone-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-41927.json"
}
}
],
"modified": "2026-10-28T02:30:23.052779975Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41927.json",
"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mq7h-5574-hw9f",
"https://nvd.nist.gov/vuln/detail/CVE-2022-41927",
"https://github.com/xwiki/xwiki-platform/commit/7fd4cda0590180c4d34f557597e9e10e263def9e"
],
"provider_metadata": {
"cwe_ids": [
"CWE-352"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41927.json"
}
},
"related_cves": [
{
"value": "CVE-2022-41927",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 489677,
"published_at": "2022-11-23T00:00:00+00:00"
}