PT-2022-26163 · Xwiki · Xwiki Platform

Published 2022-11-21 · Updated 2023-07-10 · CVE-2022-41932

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 13.10.8 XWiki Platform versions prior to 14.4.2 XWiki Platform versions prior to 14.6RC1

Description The issue allows an attacker to create many new schemas and fill them with tables by using a crafted user identifier in the login form, potentially leading to degraded database performance.

Recommendations For versions prior to 13.10.8, upgrade to version 13.10.8 or later. For versions prior to 14.4.2, upgrade to version 14.4.2 or later. For versions prior to 14.6RC1, upgrade to version 14.6RC1 or later. As a temporary workaround, consider using an authenticator that interprets the login as a reference to a document. Alternatively, using a different database than PostgreSQL may mitigate the issue.

Exploit

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2022-41932

GHSA-4X5R-6V26-7J4V

Affected Products

Xwiki Platform

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41932.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-41932 · Security Note
• https://jira.xwiki.org/browse/XWIKI-19886 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4x5r-6v26-7j4v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41932 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4x5r-6v26-7j4v · Note
• https://t.me/cvenotify/38787 · Telegram Post
• https://t.me/cvenotify/38386 · Telegram Post
• https://t.me/cibsecurity/53467 · Telegram Post