CVE-2022-23620

Katalog CVE

CVSS 5.4 · Medium EPSS 0,96%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada xwiki. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionHandler#processSx does not escape anything from SSX document references when serializing it on filesystem, it is possible to for the HTML export process to contain reference elements containing filesystem syntax like "../", "./". or "/" in general. The referenced elements are not properly escaped. This issue has been resolved in version 13.6-rc-1. This issue can be worked around by limiting or disabling document export.

Rincian

Terbit di NVD

9 Februari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-116: Improper Encoding or Escaping of Output

EPSS (30 hari)

0,96% peluang dieksploitasi; lebih tinggi dari 60,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://jira.xwiki.org/browse/XWIKI-18819 patch · advisory vendor
• https://github.com/xwiki/xwiki-platform/commit/ab778254fb8f71c774e1c1239368c44fe3b6bba5 patch · advisory pihak ketiga
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7ph6-5cmq-xgjq advisory pihak ketiga