CVE Vulnerability

CVE-2022-23615

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can save a document with the right of the current user which allow accessing API requiring programming right if the current user has programming right. This has been patched in XWiki 13.0. Users are advised to update to resolve this issue. The only known workaround is to limit SCRIPT access.

5.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8 / Impact : 4.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

Scope

5.4 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-f4cj-3q3h-884r Third Party Advisory
https://jira.xwiki.org/browse/XWIKI-5024 Patch Vendor Advisory
https://github.com/xwiki/xwiki-platform/commit/7ab0fe7b96809c7a3881454147598d46a1c9bbbe Patch Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
Information

Published : 2022-02-09 09:15

Updated : 2022-02-16 04:15

NVD link : CVE-2022-23615

Mitre link : CVE-2022-23615

Products Affected
No products.
CWE
CWE-863