CVE-2022-41937: Missing Authorization in Filter Stream Converter Application of XWiki-platform
Summary
CVE-2022-41937: Missing Authorization in Filter Stream Converter Application of XWiki-platform. Affects org.xwiki.platform:xwiki-platform-filter-ui across 3 version ranges.
< 13.10.8
>= 14.0.0, < 14.4.3
>= 14.5.0, < 14.6-rc-1
Fixed in 13.10.8, 14.4.3 or 14.6-rc-1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XWiki-platform is an open-source wiki software platform that allows users to create and collaborate on content. It provides various features such as page editing, version control, and access control. The Filter Stream Converter Application is a component of XWiki-platform that allows users to import and convert content using XAR packages.
Vulnerability Detail
The Filter Stream Converter Application in XWiki-platform is vulnerable to a missing authorization issue. This vulnerability allows any user with view access to modify any page of the wiki by importing a crafted XAR package. An attacker can exploit this vulnerability to gain unauthorized access and modify sensitive information, potentially leading to data loss or unauthorized actions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 13.10.813.10.8 -
>= 14.0.0, < 14.4.314.4.3 -
>= 14.5.0, < 14.6-rc-114.6-rc-1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate patching is not possible, a temporary workaround is to set the correct permissions for the 'Filter.WebHome' page. Only main wiki administrators should have VIEW access to this page. This can be done by editing the page and applying the changes described in the following commit: GitHub Commit
Conclusion
The missing authorization vulnerability in the Filter Stream Converter Application of XWiki-platform can allow unauthorized modification of wiki pages. It is crucial to update XWiki to the patched versions or apply the recommended workaround to mitigate the risk. Regularly updating and patching XWiki is essential to ensure the security of the platform and protect against potential vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-filter-ui →
FAQ
The vulnerability allows any user with view access to modify any page of the wiki, potentially leading to unauthorized modifications and data loss.
The vulnerability can be fixed by updating XWiki to one of the patched versions: 14.6RC1, 14.6, or 13.10.8.
Yes, a temporary workaround is to set the correct permissions for the 'Filter.WebHome' page and restrict VIEW access to main wiki administrators.
Yes, the vulnerability can be exploited to modify sensitive information and potentially lead to data loss.
You can find more information about this vulnerability in the XWiki issue tracker: https://jira.xwiki.org/browse/XWIKI-19758
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-filter-ui.
