Vulnerability · Published Sep 7, 2022 · Assigned by GitHub_M
CVE-2022-31167XWiki Platform Security Parent POM vulnerable to overwriting of security rules of a page with a final page having the same reference
High 7.1
In plain English
A high-severity missing authorization in xwiki-platform from xwiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
XWiki Platform Security Parent POM contains the security APIs for XWiki Platform, a generic wiki platform. Starting with version 5.0 and prior to 12.10.11, 13.10.1, and 13.4.6, a bug in the security cache stores rules associated to document Page1.Page2 and space Page1.Page2 in the same cache entry. That means that it's possible to overwrite the rights of a space or a document by creating the page of the space with the same name and checking the right of the new one first so that they end up in the security cache and are used for the other too. The problem has been patched in XWiki 12.10.11, 13.10.1, and 13.4.6. There are no known workarounds.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-security | 12.10.11 | GHSA-gg53-wf5x-r3r6 |
| Maven | org.xwiki.platform:xwiki-platform-security | 13.4.6 | GHSA-gg53-wf5x-r3r6 |
| Maven | org.xwiki.platform:xwiki-platform-security | 13.10.1 | GHSA-gg53-wf5x-r3r6 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| xwiki | xwiki-platform | >= 5.0, < 12.10.11>= 13.0, < 13.4.6>= 13.10, < 13.10.1 |
Weakness: CWE-285, CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
References
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gg53-wf5x-r3r6 x_refsource_CONFIRM
- https://jira.xwiki.org/browse/XWIKI-14075 x_refsource_MISC
- https://jira.xwiki.org/browse/XWIKI-18983 x_refsource_MISC