PT-2022-16134 · Unknown · Xwiki Platform

Hightmortagne · Published 2022-02-09 · Updated 2023-06-27 · CVE-2022-23620

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 13.6-rc-1

Description The issue arises from the AbstractSxExportURLFactoryActionHandler#processSx function not properly escaping SSX document references when serializing them on the filesystem. This allows the HTML export process to contain reference elements with filesystem syntax like "../", "./", or "/" in general, which can lead to security issues. The referenced elements are not properly escaped.

Recommendations For versions prior to 13.6-rc-1, update to version 13.6-rc-1 to resolve the issue. As a temporary workaround, consider limiting or disabling document export to minimize the risk of exploitation. Additionally, giving script or subwiki admin rights only to trusted people and disabling HTML/PDF export can be done as a workaround until the issue is resolved.

Exploit

Fix

Improper Encoding or Escaping of Output

Path traversal

Weakness Enumeration

CWE-116

CWE-22

Related Identifiers

CVE-2022-23620

GHSA-7PH6-5CMQ-XGJQ

Affected Products

Xwiki Platform

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23620.json · Exploit
• https://github.com/xwiki/xwiki-platform/commit/ab778254fb8f71c774e1c1239368c44fe3b6bba5 · Patch
• https://osv.dev/vulnerability/GHSA-7ph6-5cmq-xgjq · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-18819 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23620 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23620 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7ph6-5cmq-xgjq · Note
• https://t.me/cibsecurity/37130 · Telegram Post
• https://t.me/cvenotify/53107 · Telegram Post