CVE-2022-23621: Missing authorization in xwiki-platform-oldcore
Summary
CVE-2022-23621: Missing authorization in xwiki-platform. Affects org.xwiki.platform:xwiki-platform-oldcore across 3 version ranges.
< 12.10.9
>= 13.0.0, < 13.4.3
>= 13.6-rc-1, < 13.7-rc-1
Fixed in 12.10.9, 13.4.3 or 13.7-rc-1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The xwiki-platform-oldcore package is an open-source platform for developing collaborative applications. It provides a framework for creating and managing content, users, and permissions. The package is widely used for building wikis, knowledge bases, and other collaborative platforms. However, a vulnerability has been discovered in the package that allows unauthorized users with SCRIPT right to read sensitive files located in the XWiki WAR. This can lead to unauthorized access to configuration files and other sensitive information.
Vulnerability Detail
The vulnerability (CVE-2022-23621) in xwiki-platform-oldcore arises from a missing authorization check in the XWiki#invokeServletAndReturnAsString function. Any user with SCRIPT right (EDIT right before XWiki 7.4) can exploit this vulnerability to read any file located in the XWiki WAR, such as xwiki.cfg and xwiki.properties. By invoking the servlet and returning the file content as a string, an attacker can gain access to sensitive information. This vulnerability has a CVSS score of 5.5, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 12.10.912.10.9 -
>= 13.0.0, < 13.4.313.4.3 -
>= 13.6-rc-1, < 13.7-rc-113.7-rc-1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating to a patched version is not immediately feasible, a temporary workaround is to restrict the SCRIPT right to trusted users only. By limiting the access to this right, the risk of unauthorized file access can be mitigated. However, this workaround should be considered temporary, and updating to a patched version is strongly recommended.
Conclusion
The vulnerability in xwiki-platform-oldcore allows unauthorized users to read sensitive files, posing a risk of unauthorized access to configuration files and other sensitive information. It is crucial to update to the patched versions (12.10.9, 13.4.3, or 13.7-rc-1) to mitigate this vulnerability. Restricting the SCRIPT right to trusted users can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-oldcore →
FAQ
The vulnerability allows unauthorized users to read sensitive files in the XWiki WAR, potentially exposing configuration files and other sensitive information.
Users of xwiki-platform-oldcore versions 0 to 13.6 are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this advisory.
Yes, this vulnerability can be exploited remotely by unauthorized users with SCRIPT right.
Yes, this vulnerability has a CVSS score of 5.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-oldcore.
