CVE-2022-23615

 

Published at: - 09-02-2022 10:15

Last modified: - 16-02-2022 05:15

Total changes: - 3

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can save a document with the right of the current user which allow accessing API requiring programming right if the current user has programming right. This has been patched in XWiki 13.0. Users are advised to update to resolve this issue. The only known workaround is to limit SCRIPT access.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

 

Verification logic

 

Reference

• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-f4cj-3q3h-884r
• https://jira.xwiki.org/browse/XWIKI-5024
• https://github.com/xwiki/xwiki-platform/commit/7ab0fe7b96809c7a3881454147598d46a1c9bbbe

 

Keywords

NVD

 

CVE-2022-23615

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures