Vulnerability · Published Nov 23, 2022 · Assigned by GitHub_M
CVE-2022-41932Creation of new database tables through login form on PostgreSQL
High 7.5
In plain English
A high-severity uncontrolled resource consumption in xwiki-platform from xwiki. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make XWiki create many new schemas and fill them with tables just by using a crafted user identifier in the login form. This may lead to degraded database performance. The problem has been patched in XWiki 13.10.8, 14.6RC1 and 14.4.2. Users are advised to upgrade. There are no known workarounds for this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-oldcore | 13.10.8 | GHSA-4x5r-6v26-7j4v |
| Maven | org.xwiki.platform:xwiki-platform-oldcore | 14.4.2 | GHSA-4x5r-6v26-7j4v |
| Maven | org.xwiki.platform:xwiki-platform-oldcore | 14.6-rc-1 | GHSA-4x5r-6v26-7j4v |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| xwiki | xwiki-platform | < 13.10.8>= 14.0.0, < 14.4.2>= 14.5.0, < 14.6-rc-1 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H