CVE-2022-23615: Partial authorization bypass on document save in xwiki-platform
Summary
CVE-2022-23615: Partial authorization bypass on document save in xwiki-platform. Affects org.xwiki.platform:xwiki-platform-oldcore versions >= 1.0, < 13.0. Fixed in 13.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
XWiki Platform is a generic wiki platform that provides runtime services for applications built on top of it. It is vulnerable to a partial authorization bypass issue when saving a document. Any user with SCRIPT right (EDIT right before XWiki 7.4) can save a document with the right of the current user, allowing access to APIs that require programming right if the current user has programming right.
Vulnerability Detail
The vulnerability allows unauthorized users to gain access to APIs that require programming right by exploiting the authorization bypass during document save. This can lead to potential security breaches and unauthorized access to sensitive information. The issue has been patched in XWiki 13.0.
How To Fix
Minimum fixed version
13.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to XWiki 13.0 is not immediately possible, a workaround is to only grant SCRIPT right to trusted users. By limiting the access to this right, the risk of unauthorized access to APIs requiring programming right can be mitigated.
Conclusion
The partial authorization bypass vulnerability in xwiki-platform has been identified and patched in XWiki 13.0. It is crucial to upgrade to the latest version to ensure the security of your XWiki Platform installation. For further support and assistance in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-oldcore →
FAQ
XWiki Platform is a generic wiki platform that provides runtime services for applications built on top of it. It offers a wide range of features and functionalities for collaborative content creation and management.
The vulnerability allows unauthorized users to gain access to APIs that require programming right, potentially leading to security breaches and unauthorized access to sensitive information.
To fix the vulnerability, it is recommended to upgrade to XWiki 13.0 or a later version. This update includes the necessary patches to prevent the authorization bypass issue.
Yes, if upgrading to XWiki 13.0 is not immediately possible, a workaround is to only grant SCRIPT right to trusted users. By limiting the access to this right, the risk of unauthorized access to APIs requiring programming right can be mitigated.
For more information about this vulnerability, you can refer to the GitHub Security Advisory GHSA-f4cj-3q3h-884r.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-oldcore.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
