PT-2022-16128 · Xwiki · Xwiki Platform

Denis Gervalle · Published 2022-02-09 · Updated 2022-02-16 · CVE-2022-23615

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 13.0

Description The issue affects XWiki Platform, a generic wiki platform offering runtime services for applications built on top of it. In affected versions, any user with SCRIPT right can save a document with the right of the current user, allowing access to API requiring programming right if the current user has programming right.

Recommendations For versions prior to 13.0, update to XWiki 13.0 to resolve the issue. As a temporary workaround, consider limiting SCRIPT access to trusted users only.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-23615

GHSA-F4CJ-3Q3H-884R

Affected Products

Xwiki Platform

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23615.json · Exploit
• https://github.com/xwiki/xwiki-platform/commit/7ab0fe7b96809c7a3881454147598d46a1c9bbbe · Patch
• https://osv.dev/vulnerability/CVE-2022-23615 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23615 · Security Note
• https://jira.xwiki.org/browse/XWIKI-5024 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f4cj-3q3h-884r · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-f4cj-3q3h-884r · Note
• https://t.me/cibsecurity/37128 · Telegram Post
• https://t.me/cvenotify/26543 · Telegram Post