PT-2022-3499 · Xwiki · Xwiki Platform

Published 2022-05-05 · Updated 2023-07-21 · CVE-2022-29161

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 13.10.6 XWiki Platform versions prior to 14.3.1 XWiki Platform versions prior to 14.4-rc-1

Description The XWiki Crypto API generates X509 certificates signed by default using SHA1 with RSA, which is not considered safe anymore for use in certificate signatures due to the risk of collisions with SHA1. This issue may allow a remote attacker to execute arbitrary code. The API is never used in XWiki Standard but might be used in some extensions of XWiki.

Recommendations For XWiki Platform versions prior to 13.10.6, upgrade to version 13.10.6 or later. For XWiki Platform versions prior to 14.3.1, upgrade to version 14.3.1 or later. For XWiki Platform versions prior to 14.4-rc-1, upgrade to version 14.4-rc-1 or later. If an upgrade is not possible, patch the module xwiki-platform-crypto in a local installation by applying the change exposed in 26728f3 and re-compiling the module.

Exploit

Fix

Use of a Broken Cryptographic Algorithm

Inadequate Encryption Strength

Weakness Enumeration

CWE-327

CWE-326

Related Identifiers

BDU:2022-04280

CVE-2022-29161

GHSA-H8V5-P258-PQF4

Affected Products

Xwiki Platform

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29161.json · Exploit
• https://github.com/xwiki/xwiki-platform/commit/26728f3f23658288683667a5182a916c7ecefc52 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-29161 · Security Note
• https://osv.dev/vulnerability/GHSA-h8v5-p258-pqf4 · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-19676 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04280 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29161 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h8v5-p258-pqf4 · Note
• https://t.me/cvenotify/29779 · Telegram Post
• https://t.me/cibsecurity/42091 · Telegram Post