GitHub Advisoryadvisory · Maven

GHSA-f4cj-3q3h-884r Partial authorization bypass on document save in xwiki-platform

MEDIUM Published 2022-02-09 Modified 2022-05-05 Official page ↗
Aliases
CVE-2022-23615
Ecosystem
Maven
Packages
org.xwiki.platform:xwiki-platform-oldcore
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-863
Reviewed
2022-02-09

Affected packages

• Maven org.xwiki.platform:xwiki-platform-oldcore: >= 1.0, < 13.0 → fixed in 13.0

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with SCRIPT right (EDIT right before XWiki 7.4) can save a document with the right of the current user which allow accessing API requiring programming right if the current user has programming right. It has been patched in XWiki 13.0. The only workaround is to give SCRIPT right only to trusted users.

Related

Alias · CVE (1)

  • CVE-2022-23615 XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References