PT-2022-16901 · Unknown · Xwiki Platform

Simon Urli · Published 2022-04-08 · Updated 2022-04-15 · CVE-2022-24821

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 12.10.11 XWiki Platform versions prior to 13.4.6 XWiki Platform versions prior to 13.10-rc-1

Description The issue allows simple users to create global SSX/JSX without specific rights. In theory, only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. However, a bug enables anyone with edit rights to create those.

Recommendations For versions prior to 12.10.11, upgrade to version 12.10.11 or later. For versions prior to 13.4.6, upgrade to version 13.4.6 or later. For versions prior to 13.10-rc-1, upgrade to version 13.10-rc-1 or later.

Exploit

Fix

Weakness Enumeration

CWE-648

Related Identifiers

CVE-2022-24821

GHSA-GHCQ-472W-VF4H

Affected Products

Xwiki Platform

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24821.json · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-19155 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-24821 · Security Note
• https://osv.dev/vulnerability/GHSA-ghcq-472w-vf4h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24821 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ghcq-472w-vf4h · Note
• https://t.me/cibsecurity/40404 · Telegram Post