PT-2022-23181 · Xwiki · Xwiki-Platform-Web-Templates

Guillaume Coquard · Published 2022-09-08 · Updated 2023-07-21 · CVE-2022-36091

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform Web Templates versions prior to 13.10.4 and 14.2

Description The issue allows access to string and list properties of objects that the user should not have access to, including private personal information like email addresses and salted password hashes of registered users, as well as sensitive configuration fields like passwords for LDAP or SMTP servers. This can be exploited on private wikis at least for string properties by exploiting an additional vulnerability.

Recommendations For versions prior to 13.10.4, update to version 13.10.4 or later. For versions prior to 14.2, update to version 14.2 or later. As a temporary workaround, consider replacing the template file suggest.vm with a patched version without upgrading or restarting XWiki, unless it has been overridden, in which case the overridden template should be patched, too. This might need adjustments for older versions, though.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

CWE-359

Related Identifiers

CVE-2022-36091

GHSA-599V-W48H-RJRM

Affected Products

Xwiki-Platform-Web-Templates

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36091.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-36091 · Security Note
• https://osv.dev/vulnerability/GHSA-599v-w48h-rjrm · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-18849 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36091 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-599v-w48h-rjrm · Note
• https://t.me/cvenotify/35882 · Telegram Post
• https://t.me/cibsecurity/49474 · Telegram Post