PT-2022-16130 · Xwiki · Xwiki Platform

Tmortagne · Published 2022-02-09 · Updated 2022-02-15 · CVE-2022-23617

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 12.10.6 XWiki Platform versions prior to 13.2CR1

Description The issue allows any user with edit rights to copy the content of a page they do not have access to by using it as a template for a new page. There are no known workarounds for this issue.

Recommendations For versions prior to 12.10.6, update to version 12.10.6 or later. For versions prior to 13.2CR1, update to version 13.2CR1 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-23617

GHSA-GF7X-2J2X-7F73

Affected Products

Xwiki Platform

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23617.json · Exploit
• https://github.com/xwiki/xwiki-platform/commit/30c52b01559b8ef5ed1035dac7c34aaf805764d5 · Patch
• https://github.com/xwiki/xwiki-platform/commit/b35ef0edd4f2ff2c974cbeef6b80fcf9b5a44554 · Patch
• https://jira.xwiki.org/browse/XWIKI-18430 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23617 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23617 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gf7x-2j2x-7f73 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gf7x-2j2x-7f73 · Note
• https://t.me/cibsecurity/37124 · Telegram Post