XWiki Cross-Site Request Forgery (CSRF) for actions on tags
ImpactIt's possible to perform a CSRF attack for adding or removing tags on XWiki pages.PatchesThe problem has been patched in XWiki 13.10.5 and 14.3.WorkaroundsIt's possible to fix the issue without upgrading by locally modifying the documentTags.vm template in your filesystem, to apply the changes exposed there: https://github.com/xwiki/xwiki-platform/commit/7ca56e40cf79a468cea54d3480b6b403f259f9ae.Referenceshttps://jira.xwiki.org/browse/XWIKI-19550For more informationIf you have any questions or comments about this advisory:Open an issue in [Jira XWiki](https://jira.xwiki.org)Email us at [security ML](mailto:security@xwiki.org)