PT-2022-16131 · Unknown · Xwiki Platform

Sergiu Dumitriu · Published 2022-02-09 · Updated 2022-02-15 · CVE-2022-23618

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 12.10.7 XWiki Platform versions prior to 13.3RC1

Description The XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions, there is no protection against URL redirection to untrusted sites, in particular, some well-known parameters (xredirect) can be used to perform URL redirections.

Recommendations For XWiki Platform versions prior to 12.10.7, update to version 12.10.7 or later. For XWiki Platform versions prior to 13.3RC1, update to version 13.3RC1 or later. As a temporary workaround, consider restricting the use of the xredirect parameter to minimize the risk of exploitation.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2022-23618

GHSA-JP55-VVMF-63MV

Affected Products

Xwiki Platform

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23618.json · Exploit
• https://github.com/xwiki/xwiki-platform/commit/5251c02080466bf9fb55288f04a37671108f8096 · Patch
• https://osv.dev/vulnerability/GHSA-jp55-vvmf-63mv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23618 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23618 · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-10309 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jp55-vvmf-63mv · Note
• https://t.me/cvenotify/26541 · Telegram Post
• https://t.me/cibsecurity/37127 · Telegram Post