PT-2022-26161 · Xwiki · Xwiki-Platform-User-Profile-Ui

Michael Hamann · Published 2022-11-21 · Updated 2022-11-30 · CVE-2022-41930

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions xwiki-platform-user-profile-ui versions prior to 13.10.7 xwiki-platform-user-profile-ui versions prior to 14.4.2 xwiki-platform-user-profile-ui versions prior to 14.5RC1

Description The issue is related to missing authorization in the xwiki-platform-user-profile-ui, allowing any user with access to the page XWiki.XWikiUserProfileSheet to enable or disable any user profile. This could allow a disabled user to re-enable themselves or an attacker to disable any user of the wiki.

Recommendations For versions prior to 13.10.7, update to version 13.10.7 or later. For versions prior to 14.4.2, update to version 14.4.2 or later. For versions prior to 14.5RC1, update to version 14.5RC1 or later. As a temporary workaround, consider editing the page XWiki.XWikiUserProfileSheet in the wiki and performing the changes contained in the provided commit.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-41930

GHSA-P5V9-G8W8-5Q4V

Affected Products

Xwiki-Platform-User-Profile-Ui

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41930.json · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-19792 · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p5v9-g8w8-5q4v · Patch
• https://github.com/xwiki/xwiki-platform/commit/5be1cc0adf917bf10899c47723fa451e950271fa · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-41930 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41930 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p5v9-g8w8-5q4v · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cvenotify/38364 · Telegram Post