PT-2022-16135 · Xwiki · Xwiki Platform

Nancheal · Published 2022-02-09 · Updated 2023-07-13 · CVE-2022-23621

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 12.10.9 XWiki Platform versions prior to 13.4.3 XWiki Platform versions prior to 13.7-rc-1

Description The issue allows any user with SCRIPT right to read any file located in the XWiki WAR, such as xwiki.cfg and xwiki.properties, through XWiki#invokeServletAndReturnAsString as $xwiki.invokeServletAndReturnAsString("/WEB-INF/xwiki.cfg").

Recommendations For versions prior to 12.10.9, update to version 12.10.9 or later. For versions prior to 13.4.3, update to version 13.4.3 or later. For versions prior to 13.7-rc-1, update to version 13.7-rc-1 or later. As a temporary workaround, consider limiting the SCRIPT right to trusted users.

Exploit

Fix

Missing Authorization

Files Accessible to External Parties

Weakness Enumeration

CWE-862

CWE-552

Related Identifiers

CVE-2022-23621

GHSA-2JHM-QP48-HV5J

Affected Products

Xwiki Platform

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23621.json · Exploit
• https://github.com/xwiki/xwiki-platform/commit/df8bd49b5a4d87a427002c6535fb5b1746ff117a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-23621 · Security Note
• https://osv.dev/vulnerability/GHSA-2jhm-qp48-hv5j · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-18870 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23621 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2jhm-qp48-hv5j · Note
• https://t.me/cibsecurity/37122 · Telegram Post