PT-2022-16900 · Xwiki · Xwiki Platform

Surlipu · Published 2022-04-08 · Updated 2023-07-06 · CVE-2022-24820

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 12.10.11 XWiki Platform versions prior to 13.4.4 XWiki Platform versions prior to 13.9-rc-1

Description A guest user without the right to view pages of the wiki can still list documents by rendering some velocity documents.

Recommendations For versions prior to 12.10.11, update to version 12.10.11 or later. For versions prior to 13.4.4, update to version 13.4.4 or later. For versions prior to 13.9-rc-1, update to version 13.9-rc-1 or later.

Exploit

Fix

Missing Authentication

Information Disclosure

Weakness Enumeration

CWE-306

CWE-200

CWE-359

Related Identifiers

CVE-2022-24820

GHSA-QPP2-2MCP-2WM5

Affected Products

Xwiki Platform

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24820.json · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-16544 · Exploit
• https://osv.dev/vulnerability/GHSA-qpp2-2mcp-2wm5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24820 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24820 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qpp2-2mcp-2wm5 · Note
• https://t.me/cibsecurity/40409 · Telegram Post