PT-2022-23182 · Unknown · Xwiki Platform

Michael Hamann · Published 2022-09-08 · Updated 2022-09-16 · CVE-2022-36092

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform Old Core versions prior to 14.2 and 13.10.4

Description The issue allows all rights checks that would normally prevent a user from viewing a document on a wiki to be bypassed using the login action and directly specified templates. This exposes the title, content, and comments of any document and properties of objects, though the class and property name must be known. The issue is also exploitable on private wikis.

Recommendations For versions prior to 14.2, update to version 14.2 or later. For versions prior to 13.10.4, update to version 13.10.4 or later. As a temporary workaround, it is possible to protect all templates individually by adding code to check access rights first. However, due to the number of templates and the fact that some of them need to be used without view rights, this seems impractical.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2022-36092

GHSA-8H89-34W2-JPFM

Affected Products

Xwiki Platform

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36092.json · Exploit
• https://github.com/xwiki/xwiki-platform/commit/71a6d0bb6f8ab718fcfaae0e9b8c16c2d69cd4bb · Patch
• https://github.com/xwiki/xwiki-platform/commit/9b7057d57a941592d763992d4299456300918208 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-36092 · Security Note
• https://osv.dev/vulnerability/GHSA-8h89-34w2-jpfm · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-19549 · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-18602 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36092 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8h89-34w2-jpfm · Note
• https://t.me/cvenotify/35903 · Telegram Post
• https://t.me/cibsecurity/49475 · Telegram Post
• https://t.me/cvenotify/35892 · Telegram Post