PT-2022-19501 · Xwiki · Xwiki Platform

Thomas Mortagne · Published 2022-05-25 · Updated 2022-06-07 · CVE-2022-29253

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 8.3-rc-1 through 12.10.3 XWiki Platform versions prior to 13.10.3 XWiki Platform versions prior to 14.0

Description The issue allows access to any file located in the classloader using the template API and a path with ".." in it. For example, {{template name="../xwiki.hbm.xml"/}}. The confidentiality value of this advisory is considered low, as none of the available files of the classloader in XWiki Standard contain strong confidential data.

Recommendations For XWiki Platform versions 8.3-rc-1 through 12.10.3, upgrade to version 13.10.3 or 14.0. For XWiki Platform versions prior to 13.10.3, upgrade to version 13.10.3 or 14.0. For XWiki Platform versions prior to 14.0, upgrade to version 14.0. As a temporary workaround, consider restricting access to the template API until a patch is available. Administrators should upgrade their wiki to a patched version.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-24

Related Identifiers

CVE-2022-29253

GHSA-9QRP-H7FW-42HG

Affected Products

Xwiki Platform

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29253.json · Exploit
• https://github.com/xwiki/xwiki-platform/commit/4917c8f355717bb636d763844528b1fe0f95e8e2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-29253 · Security Note
• https://jira.xwiki.org/browse/XWIKI-19349 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9qrp-h7fw-42hg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29253 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9qrp-h7fw-42hg · Note