GitHub Advisoryadvisory · Maven

GHSA-ghcq-472w-vf4h Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx

MEDIUM Published 2022-04-08 Modified 2022-04-08 Official page ↗
Aliases
CVE-2022-24821
Ecosystem
Maven
Packages
org.xwiki.platform:xwiki-platform-skin-skinx
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Weaknesses
CWE-648
Reviewed
2022-04-08

Affected packages

• Maven org.xwiki.platform:xwiki-platform-skin-skinx: >= 13.5.0, < 13.10 → fixed in 13.10 • Maven org.xwiki.platform:xwiki-platform-skin-skinx: < 12.10.11 → fixed in 12.10.11 • Maven org.xwiki.platform:xwiki-platform-skin-skinx: >= 13.0.0, < 13.4.6 → fixed in 13.4.6

Description

Impact Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. Patches This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. Workarounds There's no easy workaround for this issue, administrators should upgrade their wiki. References https://jira.xwiki.org/browse/XWIKI-19155 For more information If you have any questions or comments about this advisory: • Open an issue in JIRA • Email us at XWiki Security ML

Related

Alias · CVE (1)

  • CVE-2022-24821 XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. vulnerability

Weakness · CWE (1)

  • CWE-648 Incorrect Use of Privileged APIs weakness

References