PT-2022-26168 · Xwiki · Xwiki Platform

Thomas Mortagne · Published 2022-11-21 · Updated 2022-11-28 · CVE-2022-41937

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 13.10.8 XWiki Platform versions prior to 14.6

Description The XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The application allows anyone with view access to modify any page of the wiki by importing a crafted XAR package.

Recommendations For versions prior to 13.10.8, update to version 13.10.8 or later. For versions prior to 14.6, update to version 14.6 or later. As a temporary workaround, consider setting the right of the page Filter.WebHome and making sure only the main wiki administrators can view the application installed on the main wiki or edit the page and apply the changes described in commit fb49b4f.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-41937

GHSA-Q6JP-GCWW-8V2J

Affected Products

Xwiki Platform

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41937.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-q6jp-gcww-8v2j · Patch
• https://github.com/xwiki/xwiki-platform/commit/fb49b4f289ee28e45cfada8e97e320cd3ed27113 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-41937 · Security Note
• https://jira.xwiki.org/browse/XWIKI-19758 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41937 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q6jp-gcww-8v2j · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cvenotify/38561 · Telegram Post
• https://t.me/cibsecurity/53310 · Telegram Post