PT-2022-16164 · Wiki.Js · Wiki.Js

Rubikscraft · Published 2022-02-22 · Updated 2023-07-24 · CVE-2022-23654

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Wiki.js (affected versions not specified)

Description The issue affects Wiki.js, a wiki app built on Node.js, where an authenticated user with write access on a restricted set of paths can update a page outside the allowed paths. This is possible by specifying a different target page ID while keeping the path intact, due to incorrect access control checks against user-provided values instead of the actual path associated with the page ID.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2022-23654

GHSA-3CV9-795V-6J7J

Affected Products

Wiki.Js

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23654.json · Exploit
• https://github.com/Requarks/wiki/commit/411802ec2f654bb5ed1126c307575b81e2361c6b · Patch
• https://github.com/Requarks/wiki/security/advisories/GHSA-3cv9-795v-6j7j · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-23654 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23654 · Vendor Advisory
• https://github.com/Requarks/wiki · Note
• https://t.me/cvenotify/55025 · Telegram Post
• https://t.me/cibsecurity/37901 · Telegram Post