GitHub Advisoryadvisory · Maven

GHSA-2jhm-qp48-hv5j Missing authorization in xwiki-platform

MEDIUM Published 2022-02-09 Modified 2022-02-09 Official page ↗
Aliases
CVE-2022-23621
Ecosystem
Maven
Packages
org.xwiki.platform:xwiki-platform-oldcore
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H
Weaknesses
CWE-552, CWE-862
Reviewed
2022-02-09

Affected packages

• Maven org.xwiki.platform:xwiki-platform-oldcore: >= 13.6-rc-1, < 13.7-rc-1 → fixed in 13.7-rc-1 • Maven org.xwiki.platform:xwiki-platform-oldcore: >= 13.0.0, < 13.4.3 → fixed in 13.4.3 • Maven org.xwiki.platform:xwiki-platform-oldcore: < 12.10.9 → fixed in 12.10.9

Description

Impact Any user with SCRIPT right (EDIT right before XWiki 7.4) can read any file located in the XWiki WAR (for example xwiki.cfg and xwiki.properties) through XWiki#invokeServletAndReturnAsString: ``` $xwiki.invokeServletAndReturnAsString("/WEB-INF/xwiki.cfg") ``` Patches It has been patched in XWiki versions 12.10.9, 13.4.3 and 13.7-rc-1. Workarounds The only workaround is to give SCRIPT right only to trusted users. References https://jira.xwiki.org/browse/XWIKI-18870 For more information If you have any questions or comments about this advisory: • Open an issue in Jira XWiki • Email us at our security mailing list

Related

Alias · CVE (1)

  • CVE-2022-23621 XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. vulnerability

Weakness · CWE (2)

  • CWE-552 Files or Directories Accessible to External Parties weakness
  • CWE-862 Missing Authorization weakness

References