GitHub Advisoryadvisory · Maven

GHSA-2gj2-vj98-j2qq Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore

MEDIUM Published 2022-11-21 Modified 2022-11-21 Official page ↗
Aliases
CVE-2022-41929
Ecosystem
Maven
Packages
org.xwiki.platform:xwiki-platform-oldcore
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-862
Reviewed
2022-11-21

Affected packages

• Maven org.xwiki.platform:xwiki-platform-oldcore: >= 11.7RC1, < 13.10.7 → fixed in 13.10.7 • Maven org.xwiki.platform:xwiki-platform-oldcore: >= 14.0.0, < 14.4.2 → fixed in 14.4.2

Description

Impact It's possible for a user with only Script rights to enable or disable a user: this operation should be only doable for users with admin rights. Patches This problem has been patched in XWiki 13.10.7, 14.4.2 and 14.5RC1. Workarounds There is no workaround other than upgrading the wiki, but note that this only impacts users with Script rights: administrator should take care which users have such right. References • https://jira.xwiki.org/browse/XWIKI-19804 • https://github.com/xwiki/xwiki-platform/commit/0b732f2ef0224e2aaf10e2e1ef48dbd3fb6e10cd For more information If you have any questions or comments about this advisory: • Open an issue in JIRA • Email us at security ML

Related

Alias · CVE (1)

  • CVE-2022-41929 org.xwiki.platform:xwiki-platform-oldcore is missing authorization in User#setDisabledStatus, which may allow an incorrectly authorized… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References