PT-2022-23180 · Xwiki · Xwiki

Thomas Mortagne · Published 2022-09-08 · Updated 2022-09-16 · CVE-2022-36090

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform Old Core versions prior to 13.1.0.5 and 14.3-rc-1

Description The issue arises from missing checks for inactive users in XWiki, including the REST service, allowing a disabled user to enable themselves using a REST call. Some resources handler created by extensions are also not protected by default, enabling inactive users to perform actions for such extensions. This issue has existed since at least version 1.1 of XWiki and is more critical for versions 11.3-rc-1 and later.

Recommendations For versions prior to 13.1.0.5 and 14.3-rc-1, upgrade to XWiki 13.10.5 or XWiki 14.3-rc-1 to resolve the issue. As a temporary workaround is not available, upgrading XWiki is the only solution to mitigate the risk.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2022-36090

GHSA-JGC8-GVCX-9VFX

Affected Products

Xwiki

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36090.json · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-19559 · Exploit
• https://github.com/xwiki/xwiki-platform/commit/e074d226d9b2b96a0a1ba4349d1b73a802842986 · Patch
• https://osv.dev/vulnerability/GHSA-jgc8-gvcx-9vfx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36090 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36090 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jgc8-gvcx-9vfx · Note
• https://t.me/cibsecurity/49461 · Telegram Post
• https://t.me/cvenotify/35876 · Telegram Post