PT-2022-16899 · Xwiki · Xwiki Platform

Guillaume Coquard · Published 2022-04-08 · Updated 2022-04-15 · CVE-2022-24819

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 12.10.11 XWiki Platform versions prior to 13.4.4 XWiki Platform versions prior to 13.9-rc-1

Description A guest user without the right to view pages of the wiki can still list documents related to users of the wiki. The XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

Recommendations For XWiki Platform versions prior to 12.10.11, update to version 12.10.11 or later. For XWiki Platform versions prior to 13.4.4, update to version 13.4.4 or later. For XWiki Platform versions prior to 13.9-rc-1, update to version 13.9-rc-1 or later.

Exploit

Fix

Weakness Enumeration

CWE-359

Related Identifiers

CVE-2022-24819

GHSA-97JG-43C9-Q6PF

Affected Products

Xwiki Platform

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24819.json · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-18850 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-24819 · Security Note
• https://osv.dev/vulnerability/GHSA-97jg-43c9-q6pf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24819 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-97jg-43c9-q6pf · Note
• https://t.me/cibsecurity/40410 · Telegram Post
• https://t.me/cvenotify/28670 · Telegram Post