Partial authorization bypass on document save in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with SCRIPT right (EDIT right before XWiki 7.4) can save a document with the right of the current user which allow accessing API requiring programming right if the current user has programming right. It has been patched in XWiki 13.0. The only workaround is to give SCRIPT right only to trusted users.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-23615US | medium5.4OT elevated | — | ||
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can save a document with th… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/xwiki/xwiki-platformPACKAGE
- https://github.com/xwiki/xwiki-platform/commit/7ab0fe7b96809c7a3881454147598d46a1c9bbbeWEB
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-f4cj-3q3h-884rWEB
- https://jira.xwiki.org/browse/XWIKI-5024WEB
- https://nvd.nist.gov/vuln/detail/CVE-2022-23615ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan