CVE-2022-23617: Missing authorization in xwiki-platform-oldcore
Summary
CVE-2022-23617: Missing authorization in xwiki-platform. Affects org.xwiki.platform:xwiki-platform-oldcore across 2 version ranges.
< 12.10.6
>= 13.0, < 13.2-rc-1
Fixed in 12.10.6 or 13.2-rc-1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The xwiki-platform-oldcore package is an open-source platform for developing collaborative applications. It provides a framework for creating and managing content, including pages, documents, and templates. The package is widely used in various applications and environments. However, a vulnerability has been discovered in the package that allows any user with edit rights to copy the content of a page they do not have access to by using it as a template for a new page.
Vulnerability Detail
The missing authorization vulnerability in xwiki-platform-oldcore allows unauthorized users to access and copy restricted content. This can lead to the exposure of sensitive information and potential data breaches. The vulnerability arises from a lack of proper access control checks when using a page as a template for a new page. As a result, any user with edit rights can bypass the access restrictions and copy the content of a restricted page. This vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 12.10.612.10.6 -
>= 13.0, < 13.2-rc-113.2-rc-1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided patches to mitigate the risk of unauthorized access to restricted content.
Conclusion
The missing authorization vulnerability in xwiki-platform-oldcore allows unauthorized users to copy restricted content. It is crucial to update to the patched versions (XWiki 13.2CR1 and 12.10.6) to mitigate the risk of unauthorized access. No known workarounds exist for this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-oldcore →
FAQ
The vulnerability allows any user with edit rights to copy the content of a restricted page, potentially exposing sensitive information and leading to data breaches.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
No, there are no known workarounds for this vulnerability. It is crucial to apply the provided patches to address the issue.
Versions 0 to 13.1 of xwiki-platform-oldcore are affected by this vulnerability.
You can find more information about this vulnerability in the XWiki Jira issue XWIKI-18430 (https://jira.xwiki.org/browse/XWIKI-18430).
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-oldcore.
