PT-2022-26167 · Xwiki · Xwiki Platform

Fabian Hafner · Published 2022-11-21 · Updated 2022-11-28 · CVE-2022-41936

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 13.10.8 XWiki Platform versions prior to 14.4.3 XWiki Platform versions prior to 14.6

Description The modifications rest endpoint does not filter out entries according to the user's rights, exposing information hidden from unauthorized users, such as comments and page names.

Recommendations For versions prior to 13.10.8, upgrade to XWiki 13.10.8 or later. For versions prior to 14.4.3, upgrade to XWiki 14.4.3 or later. For versions prior to 14.6, upgrade to XWiki 14.6 or later.

Exploit

Fix

Weakness Enumeration

CWE-359

Related Identifiers

CVE-2022-41936

GHSA-P88W-FHXW-XVCC

Affected Products

Xwiki Platform

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41936.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p88w-fhxw-xvcc · Patch
• https://github.com/xwiki/xwiki-platform/commit/38dc1aa1a4435f24d58f5b8e4566cbcb0971f8ff · Patch
• https://jira.xwiki.org/browse/XWIKI-19997 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41936 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p88w-fhxw-xvcc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41936 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cibsecurity/53301 · Telegram Post