PT-2022-16966 · Xwiki · Xwiki

Caleb James Delisle · Published 2022-04-28 · Updated 2023-07-06 · CVE-2022-24897

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki versions 2.3 through 12.6.6 XWiki versions 12.7.0 through 12.10.2 XWiki versions 13.0.0 through 13.0.0 before 13.0RC1

Description The velocity scripts are not properly sandboxed against using the Java File API to perform read or write operations on the filesystem. Writing an attacking script in Velocity requires the Script rights in XWiki, and it also requires finding an XWiki API which returns a File.

Recommendations For versions 2.3 through 12.6.6, upgrade to version 12.6.7 or later. For versions 12.7.0 through 12.10.2, upgrade to version 12.10.3 or later. For versions 13.0.0 through 13.0.0 before 13.0RC1, upgrade to version 13.0RC1 or later. As a general mitigation measure, be careful when giving Script rights in XWiki.

Exploit

Fix

Path traversal

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-22

CWE-668

Related Identifiers

CVE-2022-24897

GHSA-CVX5-M8VG-VXGC

Affected Products

Xwiki

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24897.json · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-5168 · Exploit
• https://github.com/xwiki/xwiki-commons/pull/127 · Patch
• https://github.com/xwiki/xwiki-commons/commit/215951cfb0f808d0bf5b1097c9e7d1e503449ab8 · Patch
• https://osv.dev/vulnerability/GHSA-cvx5-m8vg-vxgc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24897 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24897 · Vendor Advisory
• https://github.com/xwiki/xwiki-commons · Note
• https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-cvx5-m8vg-vxgc · Note
• https://t.me/cvenotify/29578 · Telegram Post
• https://t.me/cibsecurity/41789 · Telegram Post
• https://t.me/cvenotify/53754 · Telegram Post