CVE-2022-41937

 

Published at: - 22-11-2022 02:15

Last modified: - 22-11-2022 02:44

Total changes: - 1

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The application allows anyone with view access to modify any page of the wiki by importing a crafted XAR package. The problem has been patched in XWiki 14.6RC1, 14.6 and 13.10.8. As a workaround, setting the right of the page Filter.WebHome and making sure only the main wiki administrators can view the application installed on main wiki or edit the page and apply the changed described in commit fb49b4f.

Common Vulnerability Scoring System (CVSS)

-

 

Verification logic

 

Reference

• https://jira.xwiki.org/browse/XWIKI-19758
• https://github.com/xwiki/xwiki-platform/commit/fb49b4f289ee28e45cfada8e97e320cd3ed27113
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-q6jp-gcww-8v2j

 

Keywords

NVD

 

CVE-2022-41937

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures